EnCase TimeLine Script
----------------------
This script gathers file information on all or selected files/folders and
presents it in a timeline view.  The user can select the timeframe to 
check and output either HTML or tab-delimited text format.  The script 
checks Created, Modified, and Accessed times and puts files in order according 
to these fields.  If a file was both Created and Accessed during the specified
time period, the file will be listed twice, once with Created highlighted
and once with Accessed highlighted.

Distribute to anyone who would like a copy, but make sure 
bug reports come directly to me so it can be fixed for everyone.

REQUIREMENTS
-EnCase Version 4.19 and above, tested only on 4.21 and 4.22 (will not work on 5)

-IMPORTANT!!! Set EnCase Time Format option to 24:00:00 instead of 12:00:00PM
 This can be found in Tools -> Options -> Global tab

-Please overwrite all files from previous script versions


Explanation of Options
----------------------

Start Date - the beginning (minimum) date and time to check, typically
	entered in the format "mm/dd/yy hh:mm:ss" (no quotes)
	e.g. "07/13/05 10:30:11"

Stop Date - the ending (maximum) date and time to check, typically
	entered in the format "mm/dd/yy hh:mm:ss" (no quotes)
	e.g. "07/14/05 10:30:11"

Investigator Name -  Enter your name here to add to the document heading
	e.g. "Joe Q. Investigator"

Title of Report - Enter the report title here to add to the document heading
	e.g. "EnCase Timeline Report for Case 1234"

Output Path - Enter a directory / folder name to send the output to,
	default is your case Export folder plus "\TimelineReport",
	if the folder exists, the script automatically renames to
	"\TimelineReport - 1", "\TimelineReport - 2",  etc.
	e.g. "C:\Case1234\Export\TimelineReport"

Bookmark entries found? - Bookmarks all entries that match the selected time
	range in order (as selected by sort settings).  This will not bookmark
	any entry that does not have a Starting Extent (EnCase is incapable of
	performing this function), though those entries will show up in text
	and HTML output.  A nice side effect of this output option is being able
	to blue check all bookmarks, right click, and choose "Tag Selected Files" 
	to immediately view the files in question within EnCase.
	Checked by default

Create text report - Outputs a tab delimited format text file with the
	extension .xls
	Checked by default

Create HTML Report - Outputs an HTML format document and a CSS stylesheet
	Checked by default

HTML Options
Version for IE - Outputs an HTML file not including HTML v4 code &#8203;
	(zero width space).  IE incorrectly interprets &#8203; and displays 
	a square box character instead.  IE version output will usually 
	require horizontal scrolling to view all fields.
	Checked by default

Version for FireFox - Outputs an HTML file replacing every backslash character
	"\" with "\&#8203;".  The zero width space character allows Firefox to 
	properly break the line and wrap to the next line without introducing a 
	visible space.
	Checked by default

Include current time in heading? - Adds the date and time that the script is 
	executed to the output heading
	Checked by default

Include criteria in heading? - Adds the Start Date and Stop Date to the
	output heading
	Checked by default

Sort Order
Ascending - Sorts output with minimum / lowest / oldest date first (top) and 
	maximum / highest / most recent date last (bottom)
	Selected by default

Descending - Sorts output with maximum / highest / most recent date first (top) 
	and minimum / lowest / oldest date last (bottom)
	Not selected by default

Check only selected files? - This will only check the files/folders you have
	selected for dates in range instead of checking the whole case
	Not checked by default

Time Options
Check Created time? - Will include Created dates/times in report
	Checked by default

Check Written time? - Will include last Written (AKA Modified) dates/times 
	in report
	Checked by default

Check Accessed time? - Will include last Accessed dates/times in report
	Checked by default






Geoff Black, EnCE
Computer Forensic Examiner
DDK Technology Group, Inc.
--------------------------
NCIS, Cyber Department
East Coast Cyber Division
GBlack@ncis.navy.mil
