CD Image Loader Plugin

363968

OpenText OpenText Community

App Support Tiers

OpenText SUPPORTED

Support via OpenText Software Support, with a ticket filed against the associated product.

PARTNER

OpenText offers a content partnership program for select partners. Support for Partner Content offerings is provided by the partner and not by OpenText of the OpenText community.

OpenText COMMUNITY

OpenText Community Content is provided by OpenText for the benefit of customers, support for it is not available via OpenText Software Support but through specific community content forums.

COMMUNITY

Community Contributed Content is provided by OpenText customers and supported by them.

EARLY ACCESS

Show less ...Show more

The downloads referenced under the "Cybersecurity Early Access" category are made available to subscribers to mitigate time-critical issues but have not undergone formal quality and performance testing associated with official OpenText/Cybersecurity product releases. OpenText has a multi-stage Quality Assurance process. During Stage 1 we conduct a resource analysis, field mapping, ensure content level 1 functionality and analysis in our sandbox environment. Stage 2 is a complete validation including production validation. This package has cleared Stage 1 validation and therefore should be deployed with the appropriate pre-production validation. OpenText strongly recommends that any downloaded content is first checked and tested thoroughly in a non-production environment before committing to production. We welcome feedback and, should any content be shown to be faulty, detrimental or carry an incorrect claim of authorship, we shall endeavor to remove or correct such content as promptly as reasonably possible once notified and validated.

OpenText | OpenText Community

This EnScript loads one or more CD/DVD-ROM ISO images into the current case. Supports multi-part images of the type created by FTK Imager.

363 downloads

Product compatibility

EnCase App Central

Description

This plugin is designed to load the CD/DVD ISO images listed in a user-specified Windows text-file into the current case. The absolute path of each-image file should be listed one-per-line; each line being terminated by the Windows carriage-return line-feed sequence. Each file of a multipart image should be listed. The first file should have an 'iso' file-extension; second and subsequent files should have the extensions 'iso01' 'iso02' etc. The image files do not have to be listed in order, for instance all of the 'iso' files could be at the top of the list with the remainder following.

The script will take a number of steps to try and identify the parameters needed to correctly mount each image the first of which is to determine the presence of raw sector data as indicated by the presence of a 10-byte sync field defined by the CD-ROM yellow-book standard. If raw sector-data isn't detected then the script will assume that the image contains 2048-byte sectors with no error correction/detection data. If raw sector data is detected then the script will treat the image as one of two types depending on the mode-byte located in the sector-header: a yellow-book CD-ROM Mode 1 disk or a green-book CD-ROM XA Mode 2 Form 1 disk. Both of these contain 2352-byte sectors consisting of 2048-bytes of user-data plus 304-bytes of error detection/correction data. For CD-ROM Mode 1 disks 16 of these 304-bytes will be located before the 2048 data-bytes and 288-bytes afterwards. For CD-ROM XA Mode 2 disks there will be 24-bytes before and 280-bytes afterwards.

The script will consider an image not to be mounted correctly if it only contains a single 'Unallocated Clusters' object. In such cases the script will write a warning to the console window. It may still be possible to mount any such image by giving it a '.dmg' file-extension and then dragging and dropping it into EnCase.

The plugin runs in the foreground thread so you will not be able to perform any other tasks during processing. If you are planning to mount a large number of CD/DVD images then you are advised to test the operation of the script using an empty case first.

Note: EnCase will not allow duplicate images to be added to a case. If this happens the script will report the duplicate as having been added even though EnCase will have blocked it.

This script was developed for use in EnCase training. For more details, please click the following link: