This script is designed to copy files (those that are entries) into a nominated folder and/or logical evidence file whilst still preserving each one's path. It will work in triage mode.
One thing to be aware of when using this script is that the names of the devices or compound-files containing files that are to be extracted are not guaranteed to be unique. If files are extracted from devices or compound-files with duplicate names this will cause their paths to be merged thus making it very difficult to identify each one's source.
In order to solve this problem the script can prefix each extracted file's output path with the GUID of the physical device or compound file from whence the file originates.
Note that this script will not process artifacts (records), internal files, deleted-overwritten files, files zero bytes in length, unallocated clusters, volume slack or unused disk area.
This script was developed for use in EnCase training. For more details, please click the following link:
Validated for use with EnCase 23.4.
Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox
