Ch a p t e r 1 8 – S c r i p t s M o d u l e
217 | Page
Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved.
The script window lists available .pas (Pascal) scripts and their attributes.
Figure 178, Scripts Windows showing .pas file attributes
The Scripts window lists the attributes of each script:
Name: The script name is auto-generated from the ͞script.pas͟ file name.
Description and Author: These attributes are auto-generated from the
comments at the start of the script.
Modified and Created: Script dates are auto-generated from the Windows
date and time stamps of the .pas file.
Hash (SHA256): A SHA256 hash is calculated for each script. The hash is
updated each time the Scripts window is refreshed. To manually refresh the
Scripts window, right click in the Scripts window and select Refresh option
from the drop down menu.
The purpose of the SHA256 has is so that the investigator can validate the
authenticity of a GetData script, or a script from a trusted third party. GetData
script hashes are published at http://www.forensicexplorer.com/scripts.php.
If an installed script differs from the hash published on the web page it means
that the content of the script has changed.
Forensic Explorer is installed with a number of default scripts in the \Users\[user
folder]\Documents\Forensic Explorer\ path. Scripts are separated into folders,
depending on their function. These include Filters, Scripts and Startup, as described
The scripts window is where scripts are create, copied, renamed and deleted.