![]() These are now saved in a separate SQLite database file in order to overcome an issue encountered previously when saving large queries. One exception is the collection of queries used by the script. The script saves its settings in an INI file in the EnCase %PROGRAMDATA% folder for the current version. Furthermore, all output files will be written to the same folder, so the queries must have unique names. This will force Excel to treat the data as text and should prevent any automatic formatting.Įach query's output file will incorporate its name, so the latter must only include characters that are compatible with Windows file/folder names. The option is provided to have the script write each item of data in the form of '=""'. The output of each query will be written as a tab-delimited spreadsheet-file with a CSV extension. Note that a query will only be applied if it's blue-checked and binary (BLOB) data will not be extracted. In other cases, two or more queries may be needed. ![]() In some cases, only one query may be necessary to obtain the desired information. ![]() It matters not if two applications use SQLite files with the same name but different schemas - the script will retrieve the correct data from each file provided that the queries are entered correctly. If they are records, a current restriction in EnCase will require all items in the current case to be parsed: parsing selected-items will not work.įor each SQLite file that is represented as a folder, the examiner can add one or more child objects each representing a SQL query that should be applied to to that file. Target SQLite files may be in the form of entries or records. The SQLite files to be parsed should be added as folders in the left-hand side of the script's linked-list dialog-control. This script is designed as a generic parser for SQLite database files. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |