After seeing a long list of posts in the forums on credit card finder module I wanted to post an EnScript I made up for some recent cases with an overwhelming amount of credit card hits with the EnCase credit card finder module. For those of you that do not know what this algorithm is I would explain it here but it is already on Wikipedia so look there. This EnScript reduces the amount of credit card number hits dramatically, from tens of thousands to hundreds. The basics of this EnScript are it looks at search hits already created by the module and then creates bookmarks of valid credit cards. Quick note is that you have to have the search hits you want to have analyzed blue checked. Have fun.
Credit Hit Analysis
Subscribe to:
Post Comments (Atom)
7 comments:
What version of EnCase is this for? The IsValidCreditCard() Enscript string function in version 5.05 runs a Luhn check, and there have been issues with discussed for the function on version 6.x.
I have used this in 6 and 5 versions but I like to stick with 5 because it seems to be more stable. I know the script works in 5 well because I used it to drill down over 1 million CC# hits to just a few thousand.
Again, that's odd...both versions include Luhn formula/Mod-10 checks already...or, at least, that's what I've been told by EnCase.
What I've done is export the data, run my own Luhn check and removed duplicates to do considerable data reduction.
I think the the IsValidCreditCard just checks for Visa, Mastercard and Discover CC# prefixes, I know there is a difference between the IsValidCreditCard and the Luhn Algorithm.
This script doesnt work for me. Anybody else get this working on Encase 6.11? Anything extra that has to be done to get it going?
The script should work in 6.11, you have to select the hits you want to analyze by blue checking the first hit, then press shift and blue check the last search hit.
Thanks for the script. In EnCase 6.12 the script works by find/replace on the following line:
IntArray arr(0,number.GetLength());
with
IntArray arr(number.GetLength());
Seems to be an unsupported optional argument in the new version.
Post a Comment