Tools

Convert OLM to PST to access Outlook for Mac emails, contacts, & calendar in Windows Outlook. It helps you retrive corrupt or inaccessible OLM files with all metadata/properties. Both Mac and Windows experts recommend this tool for Outlok for Mac to Outlook migration.

Recovers corrupt EDB file and save them into Outlook, Live Exchange, & Microsoft 365.

Convert OST to PST and save to Exchange/Office 365. It is widely used by Outlook users and Exchange administrators to retrieve emails, attachments, contacts, & calendar from orphaned & corrupt OST files. It supports OST files of all Exchange/Outlook versions.

Android Logs Events And Protobuf Parser

This EnScript submits the hash value of files tagged with the 'VirusTotal' label via a public API to Virus Total to see if it is known as malware.

Volatility 2.4 Standalone executable integration with EnCase for centralized reporting of memory forensic results through the use of bookmarks.

This EnScript is designed to facilitate easier use of Volatility in EnCase.

VirusShare.com is a repository of malware samples to provide security researches, incident responders, forensic analysts, and the curious access to samples of malicious code because sharing is caring! Created an EnCase Analytics v5.5 Contextual Data of the VirusShare.com 0 thru 129 torrents using the logical size and MD5 sums for improved hash analysis.

VirusShare.com is a repository of malware samples to provide security researches, incident responders, forensic analysts, and the curious access to samples of malicious code because sharing is caring! Created an EnCase Cybersecurity v5.5 Hash Sets of the VirusShare.com 0 thru 129 torrents using the logical size and MD5 sums for improved hash analysis.

VirusShare.com is a repository of malware samples to provide security researches, incident responders, forensic analysts, and the curious access to samples of malicious code because sharing is caring! Created an EnCase V7 Hash Library of the VirusShare.com 0 thru 129 torrents using the logical size and MD5 sums for improved hash analysis.

This EnScipt creates thumbnails from selected movies and adds those images to a Logical Evidence File. It creates a ‘readme’ file per movie with information about the original file and the images created. Once created these items can be easily added to a case.

This script creates an EnCase hash-library from the VirusShare hash-lists available to download from https://virusshare.com.

This is a self installing EnScript plugin that allows the examiner to extract and view SQLite database files using a designated external viewer application.

This script will prompt for a keyword from the user then search selected tagged items for that keyword. It will then check the search hit to see if it is the file name in a UsnJrnl record entry. If it is a UsnJrnl record it will parse selected fields from the record and export them to a .csv file in the case default export folder. Useful for searching for change journal records in slack and unallocated space.

This is a Volume Shadow-Copy Service (VSS) examination EnScript designed for EnCase.

This EnScript plugin (formerly called the Last Folder Plugin) provides a number of utility functions.

Dieses umfassende Berichtstemplate kann als Basis für Ihre eigene Vorlage dienen. Sie ist sehr umfangreich und enthält Bookmark-Verzeichnisse für die häufigsten Topics Ihrer Untersuchungen. Die Darstellung der verschiedenen Lesezeichen wurde gemäß Kundenwünschen angepasst und kann selbstverständlich weiter optimiert werden.

This EnScript is designed to decode data stored in the HKCU Registry UserAssist sub-key present in Windows XP and later operating systems.

This will add a right click option to unmount a compound file. This can be used to try a different password or just get rid of the additional items. NOTE: Unmounting a compound file will disconnect any bookmarks that were made of items inside the compound file.

This script parses Windows Vista, Windows 7, Windows 8 and Windows 10 thumbcache_*.db files.