alivirgo/major-ai-skills/encase

┌─────────────────────────────────────────────────────────────┐
│                 EnCase Forensic Architecture                │
│                                                             │
│  Evidence Acquisition & Integrity Layer                     │
│  ├── E01 / Ex01 Container (MD5/SHA1 Checksums per Chunk)    │
│  ├── Hardware Write-Blocker Integration (Tableau / FastBloc)│
│  └── SAFE Remote Network Endpoint Acquisition Engine        │
│                                                             │
│  Processing & Automation Stack                              │
│  ├── EnCase Evidence Processor (EEP - Registry, LNK, EVTX)  │
│  ├── EnScript Object Model Engine (EntryClass, BookmarkClass│
│  └── Indexed Search Engine (Full Unicode Stemming)          │
└─────────────────────────────────────────────────────────────┘

// EnScript: Recursive LNK Shortcut & Evidence Bookmark Harvester
class MainClass {
  void Main(CaseClass c) {
    if (!c) {
      SystemClass::Message(SystemClass::MB_ICONEXCLAMATION, "Error", "No case currently open in EnCase.");
      return;
    }
 
    BookmarkClass rootBookmark = c.BookmarkRoot();
    BookmarkClass targetFolder();
    targetFolder.SetName("Suspicious LNK Shortcuts");
    rootBookmark.AddFolder(targetFolder);
 
    uint matchCount = 0;
 
    // Traverse all evidence items in case
    for (ItemIteratorClass iter(c); ItemClass item = iter.GetNextItem();) {
      EntryClass entry = EntryClass::List(item);
      if (entry) {
        ProcessEntry(entry, targetFolder, matchCount);
      }
    }
 
    SystemClass::Message(SystemClass::MB_ICONINFORMATION, "Complete", 
      String::Format("Completed scan. Tagged {0} LNK files.", matchCount));
  }
 
  void ProcessEntry(EntryClass entry, BookmarkClass targetFolder, uint &matchCount) {
    // Check if extension is .lnk
    if (entry.Extension().Compare("lnk") == 0) {
      BookmarkClass newBm();
      newBm.SetName(entry.Name());
      newBm.SetComment(String::Format("Logical Size: {0} bytes | Path: {1}", entry.LogicalSize(), entry.FullPath()));
      targetFolder.AddChild(newBm);
      matchCount++;
    }
 
    // Recurse child directories
    for (EntryClass child = entry.FirstChild(); child; child = child.Next()) {
      ProcessEntry(child, targetFolder, matchCount);
    }
  }
}

# 1. Inspect E01 Forensic Image Metadata & Hashes via libewf
ewfinfo "C:\Evidence\Workstation_Image.E01"
 
# 2. Mount E01 Image as Raw Device on Linux Host
ewfmount "C:\Evidence\Workstation_Image.E01" /mnt/ewf/
 
# 3. Acquire Physical Drive into E01 using Linux CLI
ewfacquire -t evidence_disk -S 2G /dev/nvme0n1