Tuesday, March 25, 2008

Prefetch Fix posted

So I have got a few comments on the output that the prefetch gives on the location of the executable, it gave the location as a bunch of numbers instead of text, sorry coding laziness problem. I have fixed this now, I previously selected the wrong bookmark type for the report output; it was for a number and not text so this should be fixed with this version. There were also comments on the date and time that is reported I am working on this bug as I think it has to do with the early daylight savings time and how that is represented in EnCase, I have not had time to pin this down yet. I will also be working on getting the data exported to Excel. Thanks for the comments on the blog and within the forums. The link previously posted will point you to the new prefetch EnScript and so should this one.

Prefetch Folder Analysis