-
Notifications
You must be signed in to change notification settings - Fork 16
/
Export Search Hits.EnScript
46 lines (39 loc) · 1.03 KB
/
Export Search Hits.EnScript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
/*
lance @ forensickb.com
May 27, 2008
EnCase 6.10
Select the Search hits you wanted exported from the text file and then look in
your case default export folder for a file named "searchhits.txt"
*/
class MainClass {
void Main(CaseClass c) {
EntryFileClass file();
LocalFileClass local();
SearchHitClass hit = c.SearchHitRoot();
local.Open(c.ExportFolder() + "\\" + "searchhits.txt", FileClass::WRITE);
local.SetCodePage(0);
forall (SearchHitClass h in hit){
if (h.IsSelected() && h.GetEntry()){
file.Open(h.GetEntry());
file.SetCodePage(0);
file.Seek(h.FileOffset());
FindBeginning (file);
String line;
file.ReadString(line, -1, "\r");
local.Write(line+"\r\n");
}
}
}
void FindBeginning (FileClass &file){
bool begin;
while (begin == false){
file.Skip(-1);
uint temp = file.Get();
if (temp == 0x0a)
begin = true;
else {
file.Skip(-1);
}
}
}
}