Support Forums

Hey all,

I've been writing some ProScripts for a bit, posting them here, and experimenting on my own.  I've also been over in the EnCase forums and seen the plethora of posts about how an EnScript that worked on v4.22 doesn't work (or isn't available) on v5.x+. 

What functionality are you all looking for in ProDiscover?  What kinds of things do you need from your ProScripts?

Harlan
http://windowsir.blogspot.com

Harlan,

I had an interesting request from someone in a class I taught at HTCIA International this year. They were interested in a script to parse out a BIOS image, for specific settings such as disk protection, TPM etc.  Given that our ability to image the BIOS is fairly new as are ACPI BIOS Rootkits, this could prove useful.

Harlan,

Another recent request was a  ProScript to create concordance and/or summation load files in support of civil discovery document review.

Chris:

Harlan,

I had an interesting request from someone in a class I taught at HTCIA International this year. They were interested in a script to parse out a BIOS image, for specific settings such as disk protection, TPM etc.  Given that our ability to image the BIOS is fairly new as are ACPI BIOS Rootkits, this could prove useful.

Chris,

Sorry for the late reply, but you're right, it would be useful.  All that is needed is a description of the BIOS format...