When an investigation comes down to just a few files of interest, it is critical to extract every piece of available information about the file. Embedded metadata, often overlooked, can provide us with crucial information that solidifies the evidentiary value of a given file. Whether it is gathering authorship information from Microsoft Office files, mapping GPS coordinates from pictures, or extracting compilation information from executables, we can learn a lot more about files we are investigating. In this chapter, we will develop scripts to examine these file formats, and others, to extract key information for our review. We will illustrate how to integrate these recipes with EnCase, the popular forensic suite, and add them to your investigative workflow.
In particular, we will develop code that highlights the following:
- Parsing ID3 and QuickTime-formatted metadata...
