forked from lancemueller/EnCase-EnScripts
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathList filetypes by extensions.EnScript
53 lines (36 loc) · 1.38 KB
/
List filetypes by extensions.EnScript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
/*
May 16, 2008
This EnScript will display all the extensions for all the evidence loaded in EnCase and then the count for the number of files with a given extension. Output is displayed in the CONSOLE tab of EnCase.
The EnScript also creates a local file named "File Count by extension.csv" in the EnCase default export folder that will open by default (based on the .csv extension) by Excel. It can then be sorted how you wish.
*/
class MainClass {
NameListClass list;
void Parse(EntryClass entry){
forall (EntryClass e in entry){
if (e.Extension()){
String lowerext = e.Extension();
lowerext.ToLower();
NameListClass temp = list.Find(lowerext);
if (temp){
new NameListClass (temp, e.Name(),0);
}
else {
NameListClass temp2 = new NameListClass (list, lowerext,0);
new NameListClass (temp2, e.Name(),0);
}
}
}
}
void Main(CaseClass c) {
SystemClass::ClearConsole();
list = new NameListClass();
LocalFileClass local();
local.Open(c.ExportFolder() + "\\" + "File Count by extension.csv", FileClass::WRITE);
Parse(c.EntryRoot());
foreach (NameListClass l in list){
Console.WriteLine(l.Name() + "\t" + l.Count());
local.WriteLine(l.Name() + "\t" + l.Count());
}
}
}