EnCase TimeLine Script
----------------------

---------
Known issues 
---------
-Script malfunctions using 12-hour clock format, this is a confirmed bug in EnCase v4
that will not be fixed - YOU MUST USE 24:00:00 AS YOUR TIME FORMAT

-If opening tab delimited file in Excel (tested in 2003), Excel clips the "seconds" 
field by default from the time display and the column must be formatted to include this.  
Recommended format is 'yyyy-mm-dd hh:mm:ss', 'mm/dd/yyyy hh:mm:ss', or similar 
depending on your viewing preference.

-If copying text from the HTML view, use the IE version, as the zero width space 
character  from the FireFox version will be copied even though it is not visible.

---------
v20050912
---------
New features 
---------
-Wiped out original sorting algorithm and reworked using a Radix-style sort.  This greatly
decreases processing time (on a P4 2 GHz 512 MB RAM it will find, sort, and output 300,000
entries in approximately 8 seconds).

---------
v20050808
---------
Bug fixes
---------
-Fixed bookmarking feature to keep it from trying to bookmark entries with null starting
extents. This unhandled error would result in bookmarks of the top level "Cases" instead
of the invalid file (which can't be bookmarked by EnCase anyway).


---------
v20050802
---------
New features 
---------
-Added ability to add bookmarks for all files returned in results
---------
Bug fixes
---------
-Rearranged and grouped script options for easier reading

-Changed wording on form to say "Check only selected files?" instead of "List only selected 
folders?"


---------
v20050730
---------
Bug fixes
---------
-Fixed HTML output - when selecting both FireFox and IE versions, FireFox version would double
up column output


---------
v20050711
---------
Bug fixes
---------
-Fixed status bar update to more accurately calculate time remaining


---------
v20050707
---------
New features 
---------
-Added option to check (and therefore output) any combination of Created, Accessed, 
Written dates/times (all checked by default)

-Added option to create separate versions for IE and FireFox
IE has a deficiency in handling the zero width space character &#8203; and presents 
a squared block character in its place, FireFox correctly handles this and thus 
correctly wraps text in HTML format.  You can also use the IE version if you 
frequently copy paths out of the HTML to paste elsewhere as the &#8203; char will 
get copied as well

-Added "Activity Type" field to text output, values as follows: "C" = Created, 
"W" = Written, "A" = Accessed
---------
Bug fixes
---------
-Tab delimited output was adding "\&#8203;" in path for every "\"

-Hard coded font size in stylesheet by px instead of "small", "xx-small", etc. 
that are handled differently by IE and FireFox

-Added GNB_LogLib to distribution for code retention and continuity


---------
v20050624
---------
New features
---------
-Added option to sort Ascending or Descending

-Added option to output to tab delimited text






Geoff Black, EnCE
Computer Forensic Examiner
NCIS, Cyber Department
East Coast Cyber Division
GBlack@ncis.navy.mil
