Belkasoft Web: http://belkasoft.com Email: [email protected]
Belkasoft Evidence Center 2015 Scripting Api Reference
(C) Belkasoft 2015
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Table of Contents API Namespace ...... 12 Browser Class...... 12 Browser.CacheItems Property ...... 13 Browser.Cookies Property ...... 14 Browser.DownloadedFiles Property ...... 14 Browser.Favorites Property ...... 14 Browser.FormValues Property ...... 14 Browser.Passwords Property ...... 15 Browser.TypedUrls Property ...... 15 Browser.Urls Property ...... 15 ByteSearch Class ...... 15 ByteSearch Constructor ...... 16 ByteSearch.AddSignature Method ...... 17 ByteSearch.ClearSignaures Method ...... 17 ByteSearch.Find Method ...... 17 ByteSearchHit Class ...... 17 ByteSearchHit Constructor ...... 19 ByteSearchHit.Length Property ...... 19 ByteSearchHit.Offset Property ...... 19 ByteSearchHit.Signature Property...... 20 ByteSearchSignature Class ...... 20 ByteSearchSignature Constructor (Byte[], Byte[], Int64, String) ...... 21 ByteSearchSignature Constructor (Byte[], Int64, String) ...... 21 ByteSearchSignature.Footer Property...... 22 ByteSearchSignature.Header Property ...... 22 ByteSearchSignature.Length Property ...... 22 ByteSearchSignature.Name Property ...... 22 CacheItem Class ...... 23 CacheItem.AccessCount Property ...... 24 CacheItem.AccessedDateLocal Property ...... 24 CacheItem.AccessedDateUtc Property ...... 24 CacheItem.CacheData Property ...... 24
2 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.CacheFileIsCollection Property ...... 25 CacheItem.CacheFilePath Property ...... 25 CacheItem.CacheStatus Property ...... 25 CacheItem.CreationDateLocal Property ...... 25 CacheItem.CreationDateUtc Property ...... 26 CacheItem.ExpiredDateLocal Property ...... 26 CacheItem.ExpiredDateUtc Property ...... 26 CacheItem.FileSize Property ...... 26 CacheItem.HttpHeaders Property ...... 27 CacheItem.LocationData Property ...... 27 CacheItem.ModifiedDateLocal Property ...... 27 CacheItem.ModifiedDateUtc Property ...... 27 CacheItem.RelatedFiles Property ...... 28 CacheItem.SyncDateLocal Property ...... 28 CacheItem.SyncDateUtc Property ...... 28 CacheItem.IsImageUrl Method ...... 28 Case Class ...... 29 Case.CreatedAt Property ...... 29 Case.CreatedBy Property ...... 29 Case.CurrentCase Property ...... 30 Case.DataSources Property ...... 30 Case.Description Property ...... 31 Case.Name Property ...... 31 Contact Class ...... 31 Contact.ConversationCount Property ...... 31 Contact.Conversations Property ...... 32 Contact.FirstName Property ...... 32 Contact.IsGroupContact Property ...... 32 Contact.LastName Property ...... 32 Contact.MessengerType Property ...... 33 Contact.Nick Property ...... 33 Contact.Uin Property ...... 33 Conversation Class...... 33 Conversation.Contact Property ...... 34
3 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Conversation.ExternalFromIp Property...... 35 Conversation.ExternalToIp Property ...... 35 Conversation.FromUin Property ...... 35 Conversation.InternalFromIp Property ...... 35 Conversation.InternalToIp Property ...... 36 Conversation.IsDeleted Property ...... 36 Conversation.LocalTime Property ...... 36 Conversation.Participants Property ...... 36 Conversation.Sent Property ...... 37 Conversation.Text Property ...... 37 Conversation.ToUin Property ...... 37 Conversation.Uin Property ...... 37 Conversation.UtcTime Property ...... 38 Conversation.GetAuthor Method ...... 38 Conversation.ShortMessageText Method ...... 38 Cookie Class ...... 38 Cookie.AccessCount Property ...... 39 Cookie.CookieKey Property ...... 40 Cookie.CreationDate Property ...... 40 Cookie.ExpireDateLocal Property ...... 40 Cookie.ExpireDateUtc Property ...... 40 Cookie.FileName Property...... 41 Cookie.FileSize Property ...... 41 Cookie.Host Property ...... 41 Cookie.LastVisitDate Property ...... 41 Cookie.ModifiedDateLocal Property ...... 42 Cookie.ModifiedDateUtc Property ...... 42 Cookie.Secure Property ...... 42 Cookie.UserName Property ...... 42 Cookie.Value Property ...... 43 DataSource Class ...... 43 DataSource.Browsers Property ...... 44 DataSource.ChildrenDataSources Property ...... 44 DataSource.DiskType Property ...... 44
4 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
DataSource.Documents Property ...... 44 DataSource.EncryptedFiles Property...... 45 DataSource.InstantMessengers Property ...... 45 DataSource.MailBoxes Property ...... 45 DataSource.Path Property ...... 45 DataSource.Pictures Property ...... 46 DataSource.Size Property ...... 46 DataSource.SystemEventLogs Property ...... 46 DataSource.Videos Property ...... 46 Document Class ...... 47 Document.DocumentStatus Property ...... 48 Document.FileAccessTimeUTC Property ...... 48 Document.FileCreationTimeUTC Property ...... 48 Document.FileModificationTimeUTC Property ...... 48 Document.FileName Property ...... 49 Document.FilePath Property ...... 49 Document.FileSizeInBytes Property ...... 49 Document.FileType Property ...... 49 Document.HasEmbeddedFiles Property ...... 50 Document.MetaProperties Property ...... 50 Document.RecognizedText Property ...... 50 Document.TextPreview Property ...... 50 DownloadedFile Class ...... 51 DownloadedFile.EndTimeUtc Property ...... 51 DownloadedFile.Name Property ...... 52 DownloadedFile.Size Property ...... 52 DownloadedFile.StartTimeUtc Property ...... 52 DownloadedFile.Target Property ...... 52 EncryptedFile Class ...... 53 EncryptedFile.Complexity Property ...... 54 EncryptedFile.FileType Property ...... 54 EncryptedFile.Md5 Property ...... 54 EncryptedFile.OpenPassword Property ...... 54 EncryptedFile.Passwords Property ...... 55
5 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
EncryptedFile.Path Property ...... 55 EncryptedFile.ProtectionFeatures Property ...... 55 EncryptedFile.RecoveryOptions Property ...... 55 EncryptedFile.TypeDetails Property ...... 56 Favorite Class ...... 56 Favorite.Link Property ...... 57 Favorite.Name Property ...... 57 FormValue Class ...... 57 FormValue.FieldName Property ...... 58 FormValue.FieldValue Property ...... 59 InstantMessenger Class ...... 59 InstantMessenger.AllConversations Property ...... 60 InstantMessenger.Contacts Property ...... 60 InstantMessenger.MessengerType Property ...... 61 InstantMessenger.Owner Property ...... 61 Mail Class ...... 61 Mail.Attaches Property ...... 62 Mail.BccAddress Property ...... 62 Mail.CcAddress Property ...... 62 Mail.Date Property ...... 62 Mail.EMailHeader Property ...... 63 Mail.ImportanceLevel Property ...... 63 Mail.MessageSize Property ...... 63 Mail.ReadReceipt Property ...... 63 Mail.Receiver Property ...... 64 Mail.SendToAddress Property ...... 64 Mail.Sender Property ...... 64 Mail.SenderDate Property ...... 64 Mail.Subject Property ...... 65 Mail.Text Property ...... 65 Mail.Topic Property ...... 65 MailBox Class ...... 65 MailBox.MailClientType Property ...... 66 MailBox.MailFolders Property ...... 67
6 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MailFolder Class ...... 67 MailFolder.AllMails Property ...... 69 MailFolder.IsRootFolder Property ...... 69 MailFolder.MailClientType Property ...... 69 MailFolder.MailCount Property ...... 69 MailFolder.Mails Property ...... 70 MailFolder.Name Property ...... 70 MailFolder.SubFolders Property ...... 70 MailFolder.TotalMailCount Property ...... 70 MetaProperty Class ...... 71 MetaProperty.PropertyDescription Property ...... 71 MetaProperty.PropertyValue Property ...... 71 MetaPropertyDescription Class ...... 71 MetaPropertyDescription.Category Property ...... 72 MetaPropertyDescription.Name Property ...... 72 MetaPropertyDescription.PropertyType Property...... 72 Output Class ...... 72 Output.WriteLine Method ...... 73 Output.WriteLine (String) Method ...... 73 Output.WriteLine (String, Object()) Method ...... 74 Password Class ...... 74 Password.Decrypted Property...... 75 Password.Hostname Property ...... 76 Password.Login Property ...... 76 Password.PassPhrase Property ...... 76 Password.PasswordField Property ...... 76 Password.UserNameField Property ...... 77 Picture Class ...... 77 Picture.ContainsText Property ...... 78 Picture.FileAccessTimeUTC Property ...... 78 Picture.FileCreationTimeUTC Property ...... 78 Picture.FileModificationTimeUTC Property ...... 79 Picture.FileName Property ...... 79 Picture.FilePath Property ...... 79
7 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Picture.FileSizeInBytes Property ...... 79 Picture.FileType Property ...... 80 Picture.GpsCoordinates Property ...... 80 Picture.Height Property ...... 80 Picture.Image Property ...... 80 Picture.IsPorn Property ...... 81 Picture.MetaProperties Property ...... 81 Picture.RecognizedFaces Property ...... 81 Picture.RecognizedFacesCount Property ...... 81 Picture.RecognizedText Property ...... 82 Picture.TextPreview Property ...... 82 Picture.Width Property ...... 82 Profile Class ...... 82 Profile.Case Property ...... 83 Profile.Name Property ...... 83 Report Class ...... 83 Report.Generate (IEnumerable
8 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
9 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ReportOptions.TargetFile Property ...... 113 ReportOptions.TimePeriod Property ...... 113 ReportOptions.To Property ...... 113 SystemEventLog Class ...... 113 SystemEventLog.ComputerName Property ...... 114 SystemEventLog.Data Property ...... 115 SystemEventLog.EventCategory Property ...... 115 SystemEventLog.EventId Property ...... 115 SystemEventLog.EventType Property ...... 115 SystemEventLog.SourceName Property ...... 116 SystemEventLog.Strings Property ...... 116 SystemEventLog.Text Property ...... 116 SystemEventLog.UserSid Property ...... 116 SystemEventLog.WrittenTimeUtc Property ...... 117 TypedUrl Class ...... 117 TypedUrl.Link Property ...... 118 Url Class ...... 118 Url.AccessCount Property ...... 119 Url.Directory Property ...... 120 Url.ExpireTime Property ...... 120 Url.FirstVisitTimeLocal Property ...... 120 Url.FirstVisitTimeUtc Property ...... 120 Url.HostName Property ...... 121 Url.HttpHeaders Property ...... 121 Url.LastVisitTimeLocal Property ...... 121 Url.LastVisitTimeUtc Property ...... 121 Url.PageContent Property ...... 122 Url.PageName Property...... 122 Url.SyncTime Property ...... 122 Url.UrlFile Property ...... 122 Url.UrlType Property ...... 123 Url.UserName Property ...... 123 Video Class ...... 123 Video.FileAccessTimeUTC Property ...... 124
10 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Video.FileCreationTimeUTC Property ...... 125 Video.FileModificationTimeUTC Property...... 125 Video.FileName Property ...... 125 Video.FilePath Property ...... 125 Video.FileSizeInBytes Property ...... 126 Video.FileType Property ...... 126 Video.KeyFrames Property ...... 126 Video.MetaProperties Property ...... 127 Video.RecognizedText Property ...... 127 Video.Status Property ...... 128 Video.TextPreview Property ...... 128 CacheStatus Enumeration ...... 128 DeviceType Enumeration ...... 129 DocumentStatus Enumeration ...... 129 DocumentTypes Enumeration ...... 129 ImportanceLevel Enumeration ...... 131 MailClientType Enumeration ...... 131 MessengerType Enumeration ...... 131 ReportOrientation Enumeration ...... 133 ReportTimePeriod Enumeration ...... 134 SubfoldersStructure Enumeration...... 134 TargetFormat Enumeration ...... 134 UnprotectionComplexity Enumeration ...... 135 UrlType Enumeration ...... 135 Index ...... 136
11 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
API Namespace Classes
Browser12, ByteSearch15, ByteSearchHit17, ByteSearchSignature20, CacheItem23, Case29, Contact31,
Conversation33, Cookie38, DataSource43, Document47, DownloadedFile51, EncryptedFile53, Favorite56,
FormValue57, InstantMessenger59, Mail61, MailBox65, MailFolder67, MetaProperty71,
MetaPropertyDescription71, Output72, Password74, Picture77, Profile82, Report83, ReportOptions110,
SystemEventLog113, TypedUrl117, Url118, Video123 Enumerations
CacheStatus128, DeviceType129, DocumentStatus129, DocumentTypes129, ImportanceLevel131,
MailClientType131, MessengerType131, ReportOrientation133, ReportTimePeriod133,
SubfoldersStructure134, TargetFormat134, UnprotectionComplexity135, UrlType135
Browser Class Class represents some browser. For example, Mozilla Firefox, Google Chrome, etc. It used for analyze visited sites, cookies, saved data (passwords, form value, download files), etc. It inherits from Profile class. System.Object
API.Profile82 API.Browser C#
public sealed class Browser : Profile
12 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Browser class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First();
Output.WriteLine("Number of browser = {0}", browser.Passwords.Count()); Output.WriteLine("Number of urls = {0}", browser.Urls.Count()); Output.WriteLine("Number of cache items = {0}", browser.CacheItems.Count()); Output.WriteLine("Number of cookies = {0}", browser.Cookies.Count()); Output.WriteLine("Number of favorites = {0}", browser.Favorites.Count()); Output.WriteLine("Number of typed urls = {0}", browser.TypedUrls.Count()); Output.WriteLine("Number of form values = {0}", browser.FormValues.Count()); Output.WriteLine("Number of downloaded files = {0}", browser.DownloadedFiles.Count()); }
Properties
CacheItems13, Cookies14, DownloadedFiles14, Favorites14, FormValues14, Passwords15, TypedUrls15,
Urls15
Browser.CacheItems Property List of cache items. C#
public IEnumerable
See Also
Applies to: Browser12
13 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Browser.Cookies Property Cookies of the browser. C#
public IEnumerable
See Also
Applies to: Browser12
Browser.DownloadedFiles Property Downloaded files of the browser. C#
public IEnumerable
See Also
Applies to: Browser12
Browser.Favorites Property Favorites of the browser. C#
public IEnumerable
See Also
Applies to: Browser12
Browser.FormValues Property Saved form values of the browser. C#
public IEnumerable
See Also
Applies to: Browser12
14 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Browser.Passwords Property Saved passwords of the browser. C#
public IEnumerable
See Also
Applies to: Browser12
Browser.TypedUrls Property URLs that were typed by a user directly in the browser address box. C#
public IEnumerable
See Also
Applies to: Browser12
Browser.Urls Property Visited links. C#
public IEnumerable
See Also
Applies to: Browser12
ByteSearch Class Class represents custom carver. It used for search data by signatures. System.Object API.ByteSearch C#
public class ByteSearch
15 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of ByteSearch class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
ByteSearch byteSearch = new ByteSearch(CurrentCase.DataSources.First()); ByteSearchSignature jpegSignature = new ByteSearchSignature( new byte[3] { 0xFF, 0xD8, 0xFF }, // signature to search 10000, // max length of the carved results "JPEG" // signature name );
byteSearch.AddSignature(jpegSignature);
foreach (ByteSearchHit hit in byteSearch.Find()) { Console.WriteLine("Signature {0} : offset {1}", hit.Signature.Name, hit.Offset); } }
Constructors
ByteSearch16 Methods
AddSignature17, ClearSignaures17, Find17
ByteSearch Constructor This constructor creates a new instance of ByteSearch class. C#
public ByteSearch( DataSource dataSource )
Parameters dataSource
See Also
Applies to: ByteSearch15
16 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ByteSearch.AddSignature Method Add custom signature. C#
public void AddSignature( ByteSearchSignature signature )
Parameters signature
See Also
Applies to: ByteSearch15
ByteSearch.ClearSignaures Method Clear list of the signatures. C#
public void ClearSignaures()
See Also
Applies to: ByteSearch15
ByteSearch.Find Method Matching with given signatures in the data source. C#
public IEnumerable
See Also
Applies to: ByteSearch15
ByteSearchHit Class Class represents found matching of the given signature. System.Object API.ByteSearchHit C#
public class ByteSearchHit
17 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of ByteSearchHit class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
ByteSearch byteSearch = new ByteSearch(CurrentCase.DataSources.First()); ByteSearchSignature jpegSignature = new ByteSearchSignature( new byte[3] { 0xFF, 0xD8, 0xFF }, // signature to search 10000, // max length of the carved results "JPEG" // signature name );
byteSearch.AddSignature(jpegSignature);
foreach (ByteSearchHit hit in byteSearch.Find()) { Console.WriteLine("Signature {0} : offset {1}", hit.Signature.Name, hit.Offset); } }
Constructors
ByteSearchHit19 Properties
Length19, Offset19, Signature20
18 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ByteSearchHit Constructor This constructor creates a new instance of ByteSearchHit class. C#
public ByteSearchHit( ByteSearchSignature signature, long offset, long length = 0 )
Parameters signature Used signature. offset Offset from the beginning of the file. length Length of the comparison. See Also
Applies to: ByteSearchHit17
ByteSearchHit.Length Property Length of the comparison. C#
public long Length {get;}
See Also
Applies to: ByteSearchHit17
ByteSearchHit.Offset Property Offset from the beginning of the file. C#
public long Offset {get;}
See Also
Applies to: ByteSearchHit17
19 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ByteSearchHit.Signature Property Used signature. C#
public ByteSearchSignature Signature {get;}
See Also
Applies to: ByteSearchHit17
ByteSearchSignature Class Class represents signature. Signature contains header and footer (optionaly). Header and footer are sequence of bytes. System.Object API.ByteSearchSignature C#
public class ByteSearchSignature
Example This example demonstrates usage of ByteSearchSignature class.
public void Main() { ByteSearchSignature noNameSignature = new ByteSearchSignature( new byte[3] { 0xFF, 0xD8, 0xFF }, 10000);
ByteSearchSignature signatureWithHeader = new ByteSearchSignature( new byte[3] { 0xFF, 0xD8, 0xFF }, 10000, "Signature with header");
ByteSearchSignature signatureWithHeaderAndFooter = new ByteSearchSignature( new byte[3] { 0xF1, 0xD1, 0xF1 }, new byte[3] { 0xF2, 0xD2, 0xFF }, 20000, "Signature with header and footer"); } Constructors
ByteSearchSignature21 Properties
Footer22, Header22, Length22, Name22 20 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ByteSearchSignature Constructor (Byte[], Byte[], Int64, String) This constructor creates a new instance of ByteSearchSignature class. C#
public ByteSearchSignature( byte[] header, byte[] footer, long length, string name = "" )
Parameters header Header of the signature. footer Footer of the signature. length Length of the comparison. name Signature name (optional). See Also
Applies to: ByteSearchSignature20
ByteSearchSignature Constructor (Byte[], Int64, String) This constructor creates a new instance of ByteSearchSignature class. C#
public ByteSearchSignature( byte[] header, long maxLength, string name = "" )
Parameters header Header of the signature. maxLength Maximum length of the comparison. name Signature name (optional). See Also
Applies to: ByteSearchSignature20
21 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ByteSearchSignature.Footer Property Footer of the signature. C#
public byte[] Footer {get;}
See Also
Applies to: ByteSearchSignature20
ByteSearchSignature.Header Property Header of the signature. C#
public byte[] Header {get;}
See Also
Applies to: ByteSearchSignature20
ByteSearchSignature.Length Property Length of the comparison (or maximum length of the comparison if footer doesn't exist). C#
public long Length {get;}
See Also
Applies to: ByteSearchSignature20
ByteSearchSignature.Name Property Signature name. C#
public string Name {get;}
See Also
Applies to: ByteSearchSignature20
22 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem Class Class represents cache item i.e. file stored locally for faster displaying data on the site. For example, picture. System.Object API.CacheItem C#
public sealed class CacheItem
Example This example demonstrates usage of CacheItem class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (cacheItems == null) { return; }
foreach(CacheItem cacheItem in cacheItems) { Output.WriteLine("Cache item: http header = {0}, size = {1}", cacheItem.HttpHeaders, cacheItem.FileSize); } }
Properties
AccessCount24, AccessedDateLocal24, AccessedDateUtc24, CacheData24, CacheFileIsCollection25,
CacheFilePath25, CacheStatus25, CreationDateLocal25, CreationDateUtc26, ExpiredDateLocal26,
ExpiredDateUtc26, FileSize26, HttpHeaders27, LocationData27, ModifiedDateLocal27, ModifiedDateUtc27,
RelatedFiles28, SyncDateLocal28, SyncDateUtc28 Methods
IsImageUrl28
23 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.AccessCount Property Access count. C#
public long AccessCount {get;}
See Also
Applies to: CacheItem23
CacheItem.AccessedDateLocal Property Last access time (Local). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.AccessedDateUtc Property Last access time (UTC). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.CacheData Property Cache data. C#
public byte[] CacheData {get;}
See Also
Applies to: CacheItem23
24 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.CacheFileIsCollection Property True if the cache file is a collection; false otherwise. C#
public bool CacheFileIsCollection {get;}
See Also
Applies to: CacheItem23
CacheItem.CacheFilePath Property Path of the cache file. C#
public string CacheFilePath {get;}
See Also
Applies to: CacheItem23
CacheItem.CacheStatus Property Cache status. C#
public CacheStatus CacheStatus {get;}
See Also
Applies to: CacheItem23
CacheItem.CreationDateLocal Property Creation time (Local). C#
public Nullable
See Also
Applies to: CacheItem23
25 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.CreationDateUtc Property Creation time (UTC). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.ExpiredDateLocal Property Expired time (Local). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.ExpiredDateUtc Property Expired time (UTC). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.FileSize Property File size. C#
public long FileSize {get;}
See Also
Applies to: CacheItem23
26 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.HttpHeaders Property HTTP-headers. C#
public string HttpHeaders {get;}
See Also
Applies to: CacheItem23
CacheItem.LocationData Property Location of data. C#
public string LocationData {get;}
See Also
Applies to: CacheItem23
CacheItem.ModifiedDateLocal Property Modification time (Local). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.ModifiedDateUtc Property Modification time (UTC). C#
public Nullable
See Also
Applies to: CacheItem23
27 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
CacheItem.RelatedFiles Property Related files. C#
public IEnumerable
See Also
Applies to: CacheItem23
CacheItem.SyncDateLocal Property Syncronization time (Local). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.SyncDateUtc Property Cache synchronization time (UTC). C#
public Nullable
See Also
Applies to: CacheItem23
CacheItem.IsImageUrl Method True if the chache item is image url; false otherwise. C#
public bool IsImageUrl()
See Also
Applies to: CacheItem23
28 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Case Class Class represents case. It contains a list of data sources and some characterizing information (case name, author name, creation time and description). System.Object API.Case
C#
public sealed class Case
Example This example demonstrates usage of Case class. For using current case you can write Case.CurrentCase or CurrentCase.
public void Main() { Output.WriteLine("Case name: " + CurrentCase.Name); Output.WriteLine("Created by: " + CurrentCase.CreatedBy); Output.WriteLine("Description: " + CurrentCase.Description); Output.WriteLine("CreatedAt: " + CurrentCase.CreatedAt.ToString()); }
Properties
CreatedAt29, CreatedBy29, CurrentCase30, DataSources30, Description31, Name31
Case.CreatedAt Property Creation time. C#
public DateTime CreatedAt {get;}
See Also
Applies to: Case29
Case.CreatedBy Property Author of the case. C#
public string CreatedBy {get;}
29 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: Case29
Case.CurrentCase Property Current case. For using current case you can write Case.CurrentCase or just CurrentCase. C#
public static Case CurrentCase {get;}
Example This example demonstrates how to get current case.
public void Main() { // Both variants are right. Case case = Case.CurrentCase; Case case = CurrentCase; }
See Also
Applies to: Case29
Case.DataSources Property Data sources list of the case. C#
public IEnumerable
Example This example demonstrates usage of DataSources property.
public void Main() { IEnumerable
See Also
Applies to: Case29
30 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Case.Description Property Description of the case. C#
public string Description {get;}
See Also
Applies to: Case29
Case.Name Property Name of the case. C#
public string Name {get;}
See Also
Applies to: Case29
Contact Class Class represents contact in some instant messenger. System.Object API.Contact C#
public sealed class Contact
Properties
ConversationCount31, Conversations32, FirstName32, IsGroupContact32, LastName32, MessengerType33,
Nick33, Uin33
Contact.ConversationCount Property Messages number of the contact. C#
public int ConversationCount {get;}
See Also
Applies to: Contact31
31 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Contact.Conversations Property All conversation of the contact. C#
public IList
See Also
Applies to: Contact31
Contact.FirstName Property First name of the contact. C#
public string FirstName {get;}
See Also
Applies to: Contact31
Contact.IsGroupContact Property This property is true when the contact is a group contact (otherwise it is false). C#
public bool IsGroupContact {get;}
See Also
Applies to: Contact31
Contact.LastName Property Last name of the contact. C#
public string LastName {get;}
See Also
Applies to: Contact31
32 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Contact.MessengerType Property Type of the instant messenger. C#
public MessengerType MessengerType {get;}
See Also
Applies to: Contact31
Contact.Nick Property Nick of the contact. C#
public string Nick {get;}
See Also
Applies to: Contact31
Contact.Uin Property Contact UIN. C#
public string Uin {get;}
See Also
Applies to: Contact31
Conversation Class Class represents conversation in some instant messenger. System.Object API.Conversation C#
public sealed class Conversation
33 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Conversation class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.InstantMessengers.Count() == 0) { return; }
InstantMessenger instantMessenger = dataSource.InstantMessengers.First();
if (instantMessenger.Conversation.Count() == 0) { return; }
Conversation conversation = instantMessenger.Conversation.First();
Output.WriteLine("Conversation: author = {0}, participants = {1}", conversation.GetAuthor(), conversation.Participants); }
Properties
Contact34, ExternalFromIp35, ExternalToIp35, FromUin35, InternalFromIp35, InternalToIp36, IsDeleted36,
LocalTime36, Participants36, Sent37, Text37, ToUin37, Uin37, UtcTime38 Methods
GetAuthor38, ShortMessageText38
Conversation.Contact Property Contact. C#
public Contact Contact {get;}
See Also
Applies to: Conversation33
34 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Conversation.ExternalFromIp Property Sender external IP. C#
public string ExternalFromIp {get;}
See Also
Applies to: Conversation33
Conversation.ExternalToIp Property Recipient external IP. C#
public string ExternalToIp {get;}
See Also
Applies to: Conversation33
Conversation.FromUin Property Sender UIN. C#
public string FromUin {get;}
See Also
Applies to: Conversation33
Conversation.InternalFromIp Property Sender internal IP. C#
public string InternalFromIp {get;}
See Also
Applies to: Conversation33
35 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Conversation.InternalToIp Property Recipient internal IP. C#
public string InternalToIp {get;}
See Also
Applies to: Conversation33
Conversation.IsDeleted Property True if the conversation is deleted; false otherwise. C#
public bool IsDeleted {get;}
See Also
Applies to: Conversation33
Conversation.LocalTime Property Local time. C#
public DateTime LocalTime {get;}
See Also
Applies to: Conversation33
Conversation.Participants Property Participants of the conversation. C#
public string Participants {get;}
See Also
Applies to: Conversation33
36 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Conversation.Sent Property True if the conversation is sent; false otherwise. C#
public bool Sent {get;}
See Also
Applies to: Conversation33
Conversation.Text Property Text of the conversation. C#
public string Text {get;}
See Also
Applies to: Conversation33
Conversation.ToUin Property Recipient UIN. C#
public string ToUin {get;}
See Also
Applies to: Conversation33
Conversation.Uin Property Conversation UIN. C#
public string Uin {get;}
See Also
Applies to: Conversation33
37 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Conversation.UtcTime Property Time UTC. C#
public DateTime UtcTime {get;}
See Also
Applies to: Conversation33
Conversation.GetAuthor Method Author of the conversation. C#
public string GetAuthor()
See Also
Applies to: Conversation33
Conversation.ShortMessageText Method Short message text. C#
public string ShortMessageText()
See Also
Applies to: Conversation33
Cookie Class Class represents cookie of a browser. System.Object API.Cookie C#
public sealed class Cookie
38 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Cookie class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (cookies == null) { return; }
foreach(Cookie cookie in cookies) { Output.WriteLine("Cookie: host = {0}, key = {1}, value = {2}", cookie.Host, cookie.CookieKey, cookie.Value); } }
Properties
AccessCount39, CookieKey40, CreationDate40, ExpireDateLocal40, ExpireDateUtc40, FileName41,
FileSize41, Host41, LastVisitDate41, ModifiedDateLocal42, ModifiedDateUtc42, Secure42, UserName42,
Value43
Cookie.AccessCount Property Access count. C#
public long AccessCount {get;}
See Also
Applies to: Cookie38
39 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Cookie.CookieKey Property Cookie key. C#
public string CookieKey {get;}
See Also
Applies to: Cookie38
Cookie.CreationDate Property Creation time. C#
public Nullable
See Also
Applies to: Cookie38
Cookie.ExpireDateLocal Property Expired time (Local). C#
public Nullable
See Also
Applies to: Cookie38
Cookie.ExpireDateUtc Property Expired time (UTC). C#
public Nullable
See Also
Applies to: Cookie38
40 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Cookie.FileName Property File name. C#
public string FileName {get;}
See Also
Applies to: Cookie38
Cookie.FileSize Property File size. C#
public long FileSize {get;}
See Also
Applies to: Cookie38
Cookie.Host Property Host. C#
public string Host {get;}
See Also
Applies to: Cookie38
Cookie.LastVisitDate Property Last visit time. C#
public Nullable
See Also
Applies to: Cookie38
41 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Cookie.ModifiedDateLocal Property Modification time (Local). C#
public Nullable
See Also
Applies to: Cookie38
Cookie.ModifiedDateUtc Property Modification time (UTC). C#
public Nullable
See Also
Applies to: Cookie38
Cookie.Secure Property Secure. C#
public string Secure {get;}
See Also
Applies to: Cookie38
Cookie.UserName Property User name. C#
public string UserName {get;}
See Also
Applies to: Cookie38
42 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Cookie.Value Property Value. C#
public string Value {get;}
See Also
Applies to: Cookie38
DataSource Class Class represents a data source such as folder, drive (physical or logical) or image file. It used for getting information about stored documents, pictures, videos, browsers, mailboxes and instant messengers. System.Object API.DataSource C#
public sealed class DataSource
Example This example demonstrates usage of DataSource class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
Output.WriteLine("Size of DataSource: {0}", dataSource.Size); Output.WriteLine("Path to DataSource: {0}", dataSource.Path); Output.WriteLine("DiskType of DataSource: {0}", dataSource.DiskType);
Output.WriteLine("Instant messengers count: {0}", dataSource.InstantMessengers.Count()); Output.WriteLine("Browsers count: {0}", dataSource.Browsers.Count()); Output.WriteLine("MailBoxes count: {0}", dataSource.MailBoxes.Count()); Output.WriteLine("Pictures count: {0}", dataSource.Pictures.Count()); Output.WriteLine("Documents count: {0}", dataSource.Documents.Count()); Output.WriteLine("Videos count: {0}", dataSource.Videos.Count()); }
43 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
Browsers44, ChildrenDataSources44, DiskType44, Documents44, EncryptedFiles45, InstantMessengers45,
MailBoxes45, Path45, Pictures46, Size46, SystemEventLogs46, Videos46
DataSource.Browsers Property Browsers. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.ChildrenDataSources Property Children data sources. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.DiskType Property Type of the data source. C#
public DeviceType DiskType {get;}
See Also
Applies to: DataSource43
DataSource.Documents Property Documents. C#
public IEnumerable
44 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: DataSource43
DataSource.EncryptedFiles Property Encrypted files. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.InstantMessengers Property Instant messengers. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.MailBoxes Property Mailboxes. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.Path Property Path to the data source. C#
public string Path {get;}
45 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: DataSource43
DataSource.Pictures Property Pictures. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.Size Property Size of the data source. C#
public long Size {get;}
See Also
Applies to: DataSource43
DataSource.SystemEventLogs Property System event logs. C#
public IEnumerable
See Also
Applies to: DataSource43
DataSource.Videos Property Videos. C#
public IEnumerable
46 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: DataSource43
Document Class Class represents some document. For example, Word, Exel, Pdf, etc. System.Object API.Document C#
public sealed class Document
Example This example demonstrates usage of Document class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Documents.Count() == 0) { return; }
Document document = dataSource.Documents.First();
Output.WriteLine(document.FileName); Output.WriteLine(document.FileType); Output.WriteLine(document.DocumentStatus);
if (document.RecognizedText != null) { Console.WriteLine(document.RecognizedText); } }
Properties
DocumentStatus48, FileAccessTimeUTC48, FileCreationTimeUTC48, FileModificationTimeUTC48,
FileName49, FilePath49, FileSizeInBytes49, FileType49, HasEmbeddedFiles50, MetaProperties50,
RecognizedText50, TextPreview50
47 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Document.DocumentStatus Property Status of the document. C#
public DocumentStatus DocumentStatus {get;}
See Also
Applies to: Document47
Document.FileAccessTimeUTC Property Last access time (UTC). C#
public DateTime FileAccessTimeUTC {get;}
See Also
Applies to: Document47
Document.FileCreationTimeUTC Property Creation time of the file (UTC). C#
public DateTime FileCreationTimeUTC {get;}
See Also
Applies to: Document47
Document.FileModificationTimeUTC Property Modification time of the file (UTC). C#
public DateTime FileModificationTimeUTC {get;}
See Also
Applies to: Document47
48 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Document.FileName Property File name. C#
public string FileName {get;}
See Also
Applies to: Document47
Document.FilePath Property File path. C#
public string FilePath {get;}
See Also
Applies to: Document47
Document.FileSizeInBytes Property File size in bytes. C#
public long FileSizeInBytes {get;}
See Also
Applies to: Document47
Document.FileType Property File type. C#
public string FileType {get;}
See Also
Applies to: Document47
49 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Document.HasEmbeddedFiles Property True if the document contains embedded files; false otherwise. C#
public bool HasEmbeddedFiles {get;}
See Also
Applies to: Document47
Document.MetaProperties Property Meta properties of the document. C#
public IEnumerable
See Also
Applies to: Document47
Document.RecognizedText Property Recognized text. C#
public string RecognizedText {get;}
See Also
Applies to: Document47
Document.TextPreview Property Text preview. C#
public string TextPreview {get;}
See Also
Applies to: Document47
50 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
DownloadedFile Class Class represents a downloaded file. System.Object API.DownloadedFile C#
public sealed class DownloadedFile
Example This example demonstrates usage of DownloadedFile class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (downloadedFiles == null) { return; }
foreach(DownloadedFile file in downloadedFiles) { Output.WriteLine("Downloaded file: name = {0}, size = {1}, target = {2}", file.Name, file.Size, file.Target); } }
Properties
EndTimeUtc51, Name52, Size52, StartTimeUtc52, Target52
DownloadedFile.EndTimeUtc Property End time (UTC). C#
public DateTime EndTimeUtc {get;}
51 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: DownloadedFile51
DownloadedFile.Name Property File name. C#
public string Name {get;}
See Also
Applies to: DownloadedFile51
DownloadedFile.Size Property File size. C#
public int Size {get;}
See Also
Applies to: DownloadedFile51
DownloadedFile.StartTimeUtc Property Start time (UTC). C#
public DateTime StartTimeUtc {get;}
See Also
Applies to: DownloadedFile51
DownloadedFile.Target Property File path. C#
public string Target {get;}
52 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: DownloadedFile51
EncryptedFile Class Class represents an encrypted file. System.Object API.EncryptedFile C#
public sealed class EncryptedFile
Example This example demonstrates usage of EncryptedFile class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Videos.Count() == 0) { return; }
EncryptedFile encryptedFile = dataSource.EncryptedFiles.First();
Output.WriteLine(encryptedFile.FileType.ToString()); Output.WriteLine(encryptedFile.Md5); Output.WriteLine(encryptedFile.Complexity.ToString()); Output.WriteLine(encryptedFile.ProtectionFeatures); Output.WriteLine(encryptedFile.RecoveryOptions); Output.WriteLine(encryptedFile.Path); }
Properties
Complexity54, FileType54, Md554, OpenPassword54, Passwords55, Path55, ProtectionFeatures55,
RecoveryOptions55, TypeDetails56
53 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
EncryptedFile.Complexity Property Unprotection complexity of the file. C#
public UnprotectionComplexity Complexity {get;}
See Also
Applies to: EncryptedFile53
EncryptedFile.FileType Property File type. C#
public DocumentTypes FileType {get;}
See Also
Applies to: EncryptedFile53
EncryptedFile.Md5 Property MD5 of the file. C#
public string Md5 {get;}
See Also
Applies to: EncryptedFile53
EncryptedFile.OpenPassword Property File-open password. C#
public string OpenPassword {get;}
See Also
Applies to: EncryptedFile53
54 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
EncryptedFile.Passwords Property Passwords. C#
public IList
See Also
Applies to: EncryptedFile53
EncryptedFile.Path Property File path. C#
public string Path {get;}
See Also
Applies to: EncryptedFile53
EncryptedFile.ProtectionFeatures Property Protection features. C#
public string ProtectionFeatures {get;}
See Also
Applies to: EncryptedFile53
EncryptedFile.RecoveryOptions Property Recovery options. C#
public string RecoveryOptions {get;}
See Also
Applies to: EncryptedFile53
55 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
EncryptedFile.TypeDetails Property Type details. C#
public string TypeDetails {get;}
See Also
Applies to: EncryptedFile53
Favorite Class Class represents a favorite link. System.Object API.Favorite C#
public sealed class Favorite
Example This example demonstrates usage of Favorite class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (favorites == null) { return; }
foreach(Favorite favorite in favorites) { Output.WriteLine("Favorite: name = {0}, link = {1}", favorite.Name, favorite.Link); } }
56 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
Link57, Name57
Favorite.Link Property The favorite link. C#
public string Link {get;}
See Also
Applies to: Favorite56
Favorite.Name Property Name of the favorite link. C#
public string Name {get;}
See Also
Applies to: Favorite56
FormValue Class Class represents a form value. System.Object API.FormValue C#
public sealed class FormValue
57 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of FormValue class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (formValues == null) { return; }
foreach(FormValue formValue in formValues) { Output.WriteLine("Form value: name = {0}, value = {1}", formValue.FieldName, formValue.FieldValue); } }
Properties
FieldName58, FieldValue59
FormValue.FieldName Property Field name. C#
public string FieldName {get;}
See Also
Applies to: FormValue57
58 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
FormValue.FieldValue Property Field value. C#
public string FieldValue {get;}
See Also
Applies to: FormValue57
InstantMessenger Class Class represents some instant messenger. For example, ICQ, Mail.Ru, Qip, Skype, Google Talk, etc. It used for investigation contacts and conversations. It inherits from Profile class. System.Object
API.Profile82 API.InstantMessenger C#
public sealed class InstantMessenger : Profile
59 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of InstantMessenger class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.InstantMessengers.Count() == 0) { return; }
InstantMessenger instantMessenger = dataSource.InstantMessengers.First();
Output.WriteLine("Messenger type = {0}, owner = {1} {2} ({3})", instantMessenger.MessengerType, instantMessenger.Owner.FirstName, instantMessenger.Owner.LastName, instantMessenger.Owner.Nick);
foreach(Contact contact in instantMessenger.Contacts) { Output.WriteLine("Contact: name = {0} {1} ({2}),", contact.FirstName, contact.LastName, contact.Nick); } }
Properties
AllConversations60, Contacts60, MessengerType61, Owner61
InstantMessenger.AllConversations Property List of all found conversations. C#
public IList
See Also
Applies to: InstantMessenger59
InstantMessenger.Contacts Property List of all found contacts. C#
public IList
60 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: InstantMessenger59
InstantMessenger.MessengerType Property Type of the instant messenger. C#
public MessengerType MessengerType {get;}
See Also
Applies to: InstantMessenger59
InstantMessenger.Owner Property Owner. C#
public Contact Owner {get;}
See Also
Applies to: InstantMessenger59
Mail Class Class represent a mail. System.Object API.Mail C#
public sealed class Mail
Properties
Attaches62, BccAddress62, CcAddress62, Date62, EMailHeader63, ImportanceLevel63, MessageSize63,
ReadReceipt63, Receiver64, SendToAddress64, Sender64, SenderDate64, Subject65, Text65, Topic65
61 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Mail.Attaches Property Attaches of the mail. C#
public IEnumerable
See Also
Applies to: Mail61
Mail.BccAddress Property Email address for blind carbon copy (BCC). C#
public string BccAddress {get;}
See Also
Applies to: Mail61
Mail.CcAddress Property Email address for carbon copy (CC). C#
public string CcAddress {get;}
See Also
Applies to: Mail61
Mail.Date Property Date (UTC) when the mail was received. C#
public Nullable
See Also
Applies to: Mail61
62 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Mail.EMailHeader Property Email address of the sender. C#
public string EMailHeader {get;}
See Also
Applies to: Mail61
Mail.ImportanceLevel Property Importance level of the mail. C#
public ImportanceLevel ImportanceLevel {get;}
See Also
Applies to: Mail61
Mail.MessageSize Property Message size. C#
public int MessageSize {get;}
See Also
Applies to: Mail61
Mail.ReadReceipt Property True if the mail was read; false otherwise. C#
public bool ReadReceipt {get;}
See Also
Applies to: Mail61
63 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Mail.Receiver Property Receiver of the mail. C#
public string Receiver {get;}
See Also
Applies to: Mail61
Mail.SendToAddress Property Email address of the receiver. C#
public string SendToAddress {get;}
See Also
Applies to: Mail61
Mail.Sender Property Sender of the mail. C#
public string Sender {get;}
See Also
Applies to: Mail61
Mail.SenderDate Property Date (UTC) when the mail was sent. C#
public Nullable
See Also
Applies to: Mail61
64 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Mail.Subject Property Subject of the mail. C#
public string Subject {get;}
See Also
Applies to: Mail61
Mail.Text Property Text of the mail. C#
public string Text {get;}
See Also
Applies to: Mail61
Mail.Topic Property Topic of the mail. C#
public string Topic {get;}
See Also
Applies to: Mail61
MailBox Class Class represents some mailbox. For example, Gmail, Outlook, The Bat. It used for analyse mails and contacts. It inherits from Profile class. System.Object
API.Profile82 API.MailBox C#
public sealed class MailBox : Profile
65 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of MailBox class for showing all mails topics.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.MailBoxes.Count() == 0) { return; }
MailBox mailBox = dataSource.MailBoxes.First();
Output.WriteLine(mailBox.MailClientType.ToString());
foreach(MailFolder folder in mailBox.MailFolders) { WriteMailsTopics(folder.AllMails); } }
void WriteMailsTopics(List
Properties
MailClientType66, MailFolders67
MailBox.MailClientType Property Type of the mailbox. C#
public MailClientType MailClientType {get;}
See Also
Applies to: MailBox65
66 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MailBox.MailFolders Property Mail folders. C#
public IEnumerable
See Also
Applies to: MailBox65
MailFolder Class Class represents a mail folder. System.Object API.MailFolder C#
public sealed class MailFolder
67 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of MailFolder class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.MailBoxes.Count() == 0) { return; }
MailBox mailBox = dataSource.MailBoxes.First();
if (mailBox.MailFolders.Count() == 0) { return; }
MailFolder folder = mailBox.MailFolders.First();
Output.WriteLine("Folder name = {0}, mail count = {1}, total mail count = {2}", folder.Name, folder.MailCount, folder.TotalMailCount);
if (folder.TotalMails == null) { return; }
foreach(Mail mail in folder.TotalMails) { Output.WriteLine("Mail topic = {0}, sender = {1}, receiver = {2}", mail.Topic, mail.Sender, mail.Receiver); } }
Properties
AllMails69, IsRootFolder69, MailClientType69, MailCount69, Mails70, Name70, SubFolders70,
TotalMailCount70
68 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MailFolder.AllMails Property Mails from the folder and all its subfolders. C#
public List
See Also
Applies to: MailFolder67
MailFolder.IsRootFolder Property True if the folder is root; false otherwise. C#
public bool IsRootFolder {get;}
See Also
Applies to: MailFolder67
MailFolder.MailClientType Property Type of the mail client. C#
public MailClientType MailClientType {get;}
See Also
Applies to: MailFolder67
MailFolder.MailCount Property Count of mails in this folder. C#
public int MailCount {get;}
See Also
Applies to: MailFolder67
69 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MailFolder.Mails Property Mails in the mail folder. C#
public List
See Also
Applies to: MailFolder67
MailFolder.Name Property Mail folder name. C#
public string Name {get;}
See Also
Applies to: MailFolder67
MailFolder.SubFolders Property List of subfolders of this folder. C#
public IList
See Also
Applies to: MailFolder67
MailFolder.TotalMailCount Property Total mail count including mails in subfolders. C#
public int TotalMailCount {get;}
See Also
Applies to: MailFolder67
70 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MetaProperty Class Class represents meta property of some document. System.Object API.MetaProperty C#
public sealed class MetaProperty
Properties
PropertyDescription71, PropertyValue71
MetaProperty.PropertyDescription Property Property description. C#
public MetaPropertyDescription PropertyDescription {get;}
See Also
Applies to: MetaProperty71
MetaProperty.PropertyValue Property Property value. C#
public object PropertyValue {get;}
See Also
Applies to: MetaProperty71
MetaPropertyDescription Class Class represents meta property description. System.Object API.MetaPropertyDescription C#
public class MetaPropertyDescription
71 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
Category72, Name72, PropertyType72
MetaPropertyDescription.Category Property Category of the property. C#
public string Category {get;}
See Also
Applies to: MetaPropertyDescription71
MetaPropertyDescription.Name Property Property name. C#
public string Name {get;}
See Also
Applies to: MetaPropertyDescription71
MetaPropertyDescription.PropertyType Property Property type. C#
public Type PropertyType {get;}
See Also
Applies to: MetaPropertyDescription71
Output Class Class allows you to output data to Output tab. System.Object API.Output C#
public static class Output
72 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Output class.
public void Main() { Output.WriteLine("Case name: {0}", CurrentCase.Name); }
Methods
WriteLine73
Output.WriteLine Method This method writes the empty line to the Output tab. C#
public static void WriteLine()
See Also
Applies to: Output72
Output.WriteLine (String) Method This method writes the specified string value to the Output tab. C#
public static void WriteLine( string stringToWrite )
Parameters stringToWrite String for printing. See Also
Applies to: Output72
73 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Output.WriteLine (String, Object()) Method This method writes the text representation of the specified array of objects to the Output tab using the specified format information. C#
public static void WriteLine( string format, params object[] args )
Parameters format Format string for printing. args Array of arguments. See Also
Applies to: Output72
Password Class Class represents a password. System.Object API.Password C#
public sealed class Password
74 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Password class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (passwords == null) { return; }
foreach(Password password in passwords) { Output.WriteLine("Password: hostname = {0}, login = {1}, password = {2}, username = {3}", password.Hostname, password.Login, password.PasswordField, password.UserNameField); } }
Properties
Decrypted75, Hostname76, Login76, PassPhrase76, PasswordField76, UserNameField77
Password.Decrypted Property True if the password was decrypted; false otherwise. C#
public bool Decrypted {get;}
See Also
Applies to: Password74
75 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Password.Hostname Property Host name. C#
public string Hostname {get;}
See Also
Applies to: Password74
Password.Login Property Login. C#
public string Login {get;}
See Also
Applies to: Password74
Password.PassPhrase Property Pass phrase. C#
public string PassPhrase {get;}
See Also
Applies to: Password74
Password.PasswordField Property Password. C#
public string PasswordField {get;}
See Also
Applies to: Password74
76 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Password.UserNameField Property User name. C#
public string UserNameField {get;}
See Also
Applies to: Password74
Picture Class Class represents a picture. The picture can be analyzed for the presence of text, faces and pornography. System.Object API.Picture C#
public sealed class Picture
Example This example demonstrates usage of Picture class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Pictures.Count() == 0) { return; }
Picture picture = dataSource.Pictures.First();
Output.WriteLine(picture.FileName); Output.WriteLine(picture.FileType); Output.WriteLine(picture.IsPorn.ToString());
foreach(var face in picture.RecognizedFaces) { Output.WriteLine("Face {0}, {1}, {2}, {3}", face.Item1, face.Item2, face.Item3, face.Item4); } }
77 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
ContainsText78, FileAccessTimeUTC78, FileCreationTimeUTC78, FileModificationTimeUTC79, FileName79,
FilePath79, FileSizeInBytes79, FileType80, GpsCoordinates80, Height80, Image80, IsPorn81,
MetaProperties81, RecognizedFaces81, RecognizedFacesCount81, RecognizedText82, TextPreview82,
Width82
Picture.ContainsText Property True if the image contains text; false otherwise. C#
public bool ContainsText {get;}
See Also
Applies to: Picture77
Picture.FileAccessTimeUTC Property Last access time (UTC). C#
public DateTime FileAccessTimeUTC {get;}
See Also
Applies to: Picture77
Picture.FileCreationTimeUTC Property Creation time of the file (UTC). C#
public DateTime FileCreationTimeUTC {get;}
See Also
Applies to: Picture77
78 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Picture.FileModificationTimeUTC Property Modification time of the file (UTC). C#
public DateTime FileModificationTimeUTC {get;}
See Also
Applies to: Picture77
Picture.FileName Property File name. C#
public string FileName {get;}
See Also
Applies to: Picture77
Picture.FilePath Property File path. C#
public string FilePath {get;}
See Also
Applies to: Picture77
Picture.FileSizeInBytes Property File size in bytes. C#
public long FileSizeInBytes {get;}
See Also
Applies to: Picture77
79 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Picture.FileType Property File type. C#
public string FileType {get;}
See Also
Applies to: Picture77
Picture.GpsCoordinates Property GPS coordinates of the picture. C#
public Tuple
See Also
Applies to: Picture77
Picture.Height Property Picture height. C#
public int Height {get;}
See Also
Applies to: Picture77
Picture.Image Property Image. C#
public Image Image {get;}
See Also
Applies to: Picture77
80 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Picture.IsPorn Property True if the image is pornography; false otherwise. C#
public bool IsPorn {get;}
See Also
Applies to: Picture77
Picture.MetaProperties Property Meta properties of the picture. C#
public IEnumerable
See Also
Applies to: Picture77
Picture.RecognizedFaces Property Coordinates of picture areas that contains recognized faces. C#
public IEnumerable
See Also
Applies to: Picture77
Picture.RecognizedFacesCount Property Count of recognized faces. C#
public int RecognizedFacesCount {get;}
See Also
Applies to: Picture77
81 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Picture.RecognizedText Property Recognized text. C#
public string RecognizedText {get;}
See Also
Applies to: Picture77
Picture.TextPreview Property Text preview. C#
public string TextPreview {get;}
See Also
Applies to: Picture77
Picture.Width Property Picture width. C#
public int Width {get;}
See Also
Applies to: Picture77
Profile Class Class represents common properties of InstantMessenger, MailBox and Browser classes. System.Object API.Profile
API.Browser12 API.InstantMessenger59 API.MailBox65 C#
public class Profile
82 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
Case83, Name83
Profile.Case Property Case that contains this profile. C#
public Case Case {get;}
See Also
Applies to: Profile82
Profile.Name Property Profile name. C#
public string Name {get; set;}
See Also
Applies to: Profile82
Report Class Class provides a set of methods to export data. System.Object API.Report C#
public static class Report
Methods
Generate100
83 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
84 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
85 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Picture, String, TargetFormat, ReportOptions) Method Picture export. C#
public static void Generate( Picture itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Video, String, TargetFormat, ReportOptions) Method Video export. C#
public static void Generate( Video itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
86 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Document, String, TargetFormat, ReportOptions) Method Document export. C#
public static void Generate( Document itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
87 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Mail, String, TargetFormat, ReportOptions) Method Mail export. C#
public static void Generate( Mail itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
88 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
89 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
90 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
91 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
92 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
93 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
94 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
95 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Password, String, TargetFormat, ReportOptions) Method Password export. C#
public static void Generate( Password itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (MailFolder, String, TargetFormat, ReportOptions) Method Mail folder export. C#
public static void Generate( MailFolder itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
96 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (DataSource, String, TargetFormat, ReportOptions) Method Data source export. C#
public static void Generate( DataSource itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
97 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Case, String, TargetFormat, ReportOptions) Method Case export. C#
public static void Generate( Case itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Profile, String, TargetFormat, ReportOptions) Method Profile export. C#
public static void Generate( Profile itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
98 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Contact, String, TargetFormat, ReportOptions) Method Contact export. C#
public static void Generate( Contact itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
99 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Conversation, String, TargetFormat, ReportOptions) Method Conversation export. C#
public static void Generate( Conversation itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
100 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Browser, String, TargetFormat, ReportOptions) Method Browser export. C#
public static void Generate( Browser itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
101 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
102 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (MailBox, String, TargetFormat, ReportOptions) Method Mailbox export. C#
public static void Generate( MailBox itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
103 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (CacheItem, String, TargetFormat, ReportOptions) Method Cache item export. C#
public static void Generate( CacheItem itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Cookie, String, TargetFormat, ReportOptions) Method Cookie export. C#
public static void Generate( Cookie itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
104 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (DownloadedFile, String, TargetFormat, ReportOptions) Method Downloaded file export. C#
public static void Generate( DownloadedFile itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
105 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (Favorite, String, TargetFormat, ReportOptions) Method Favorite link export. C#
public static void Generate( Favorite itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (FormValue, String, TargetFormat, ReportOptions) Method Form value eport. C#
public static void Generate( FormValue itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
106 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
107 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (TypedUrl, String, TargetFormat, ReportOptions) Method Typed URL export. C#
public static void Generate( TypedUrl itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (Url, String, TargetFormat, ReportOptions) Method URL export. C#
public static void Generate( Url itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
108 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
Report.Generate (InstantMessenger, String, TargetFormat, ReportOptions) Method Instant messenger. C#
public static void Generate( InstantMessenger itemToReport, string targetFolder, TargetFormat format, ReportOptions options = null )
Parameters itemToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
109 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Report.Generate (IEnumerable
public static void Generate( IEnumerable
Parameters itemsToReport Exported data. targetFolder Target folder. format Target format. options Options. See Also
Applies to: Report83
ReportOptions Class Class represents export options. System.Object API.ReportOptions C#
public sealed class ReportOptions
Properties
Contacts111, Encoding111, From111, GeneratedBy111, OpenAfterGeneration112, PageOrientation112,
SortAscending112, SubfoldersStructure112, TargetFile113, TimePeriod113, To113
110 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ReportOptions.Contacts Property Contacts.
C#
public ContactsGenerationType Contacts {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.Encoding Property Encoding. C#
public Encoding Encoding {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.From Property Starting time of data export. C#
public DateTime From {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.GeneratedBy Property Author of the report. C#
public string GeneratedBy {get; set;}
See Also
Applies to: ReportOptions110
111 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ReportOptions.OpenAfterGeneration Property True if report will be opened after generation; false otherwise. C#
public bool OpenAfterGeneration {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.PageOrientation Property Page orientation. C#
public ReportOrientation PageOrientation {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.SortAscending Property True if sort is ascending; false otherwise. C#
public bool SortAscending {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.SubfoldersStructure Property Option of creation subfolders. C#
public SubfoldersStructure SubfoldersStructure {get; set;}
See Also
Applies to: ReportOptions110
112 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ReportOptions.TargetFile Property Target file path.
C#
public string TargetFile {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.TimePeriod Property Time period of report. C#
public ReportTimePeriod TimePeriod {get; set;}
See Also
Applies to: ReportOptions110
ReportOptions.To Property Ending time of data export. C#
public DateTime To {get; set;}
See Also
Applies to: ReportOptions110
SystemEventLog Class Class represents system event log. System.Object API.SystemEventLog C#
public sealed class SystemEventLog
113 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of SystemEventLog class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.SystemEventLogs.Count() == 0) { return; }
SystemEventLog systemEventLog = dataSource.SystemEventLogs.First();
Output.WriteLine("Computer name {0}", systemEventLog.ComputerName); Output.WriteLine("Source name {0}", systemEventLog.SourceName); Output.WriteLine("Event id {0}", systemEventLog.EventId.ToString()); Output.WriteLine("Event type {0}", systemEventLog.EventType.ToString()); Output.WriteLine("Event category {0}", systemEventLog.EventCategory.ToString()); Output.WriteLine("Written time utc {0}", systemEventLog.WrittenTimeUtc.ToString()); Output.WriteLine("Text {0}", systemEventLog.Text.ToString()); }
Properties
ComputerName114, Data115, EventCategory115, EventId115, EventType115, SourceName116, Strings116,
Text116, UserSid116, WrittenTimeUtc117
SystemEventLog.ComputerName Property Computer name. C#
public string ComputerName {get;}
See Also
Applies to: SystemEventLog113
114 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
SystemEventLog.Data Property Data. C#
public byte[] Data {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.EventCategory Property Event category. C#
public int EventCategory {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.EventId Property Event id. C#
public long EventId {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.EventType Property Event type. C#
public long EventType {get;}
See Also
Applies to: SystemEventLog113
115 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
SystemEventLog.SourceName Property Source name. C#
public string SourceName {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.Strings Property Strings of the system event log. C#
public string Strings {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.Text Property Main information about the event. C#
public string Text {get;}
See Also
Applies to: SystemEventLog113
SystemEventLog.UserSid Property User sid. C#
public string UserSid {get;}
See Also
Applies to: SystemEventLog113
116 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
SystemEventLog.WrittenTimeUtc Property Time of writing (UTC). C#
public DateTime WrittenTimeUtc {get;}
See Also
Applies to: SystemEventLog113
TypedUrl Class Class represents a URL that was typed by a user directly in the browser address box. System.Object API.TypedUrl C#
public sealed class TypedUrl
Example This example demonstrates usage of TypedUrl class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (typedUrls == null) { return; }
foreach(TypedUrl typedUrl in typedUrls) { Output.WriteLine("Typed url = {0}", typedUrl.Link); } }
117 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Properties
Link118
TypedUrl.Link Property Link. C#
public string Link {get;}
See Also
Applies to: TypedUrl117
Url Class Class represents some URL. System.Object API.Url C#
public sealed class Url
118 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Url class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Browsers.Count() == 0) { return; }
Browser browser = dataSource.Browsers.First(); IEnumerable
if (urls == null) { return; }
foreach(Url url in urls) { Output.WriteLine("Url: type = {0}, host name = {1}, http headers = {2}", url.UrlType, url.HostName, url.HttpHeaders); } }
Properties
AccessCount119, Directory120, ExpireTime120, FirstVisitTimeLocal120, FirstVisitTimeUtc120, HostName121,
HttpHeaders121, LastVisitTimeLocal121, LastVisitTimeUtc121, PageContent122, PageName122,
SyncTime122, UrlFile122, UrlType123, UserName123
Url.AccessCount Property Access count. C#
public int AccessCount {get;}
See Also
Applies to: Url118
119 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Url.Directory Property Directory. C#
public string Directory {get;}
See Also
Applies to: Url118
Url.ExpireTime Property Expire time. C#
public Nullable
See Also
Applies to: Url118
Url.FirstVisitTimeLocal Property Time of first visit (Local). C#
public Nullable
See Also
Applies to: Url118
Url.FirstVisitTimeUtc Property Time of first visit (UTC). C#
public Nullable
See Also
Applies to: Url118
120 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Url.HostName Property Host name. C#
public string HostName {get;}
See Also
Applies to: Url118
Url.HttpHeaders Property HTTP-headers. C#
public string HttpHeaders {get;}
See Also
Applies to: Url118
Url.LastVisitTimeLocal Property Last visit time (Local). C#
public Nullable
See Also
Applies to: Url118
Url.LastVisitTimeUtc Property Last visit time (UTC). C#
public Nullable
See Also
Applies to: Url118
121 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Url.PageContent Property Content of the page. C#
public string PageContent {get;}
See Also
Applies to: Url118
Url.PageName Property Name of the page. C#
public string PageName {get;}
See Also
Applies to: Url118
Url.SyncTime Property Last synchronization time. C#
public Nullable
See Also
Applies to: Url118
Url.UrlFile Property File URL. C#
public string UrlFile {get;}
See Also
Applies to: Url118
122 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Url.UrlType Property Type of the URL. C#
public UrlType UrlType {get;}
See Also
Applies to: Url118
Url.UserName Property User name. C#
public string UserName {get;}
See Also
Applies to: Url118
Video Class Class represents a video. System.Object API.Video C#
public sealed class Video
123 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of Video class.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Videos.Count() == 0) { return; }
Video video = dataSource.Videos.First(); int count = 0;
Output.WriteLine(video.FileName); Output.WriteLine(video.FileType); Output.WriteLine(video.FilePath);
foreach(var keyFrame in video.KeyFrames) { keyFrame.Image.Save(String.Format(@"C:\temp\keyFrame{0}.jpg", count)); count++; } }
Properties
FileAccessTimeUTC124, FileCreationTimeUTC125, FileModificationTimeUTC125, FileName125, FilePath125,
FileSizeInBytes126, FileType126, KeyFrames126, MetaProperties127, RecognizedText127, Status128,
TextPreview128
Video.FileAccessTimeUTC Property Last access time (UTC). C#
public DateTime FileAccessTimeUTC {get;}
See Also
Applies to: Video123
124 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Video.FileCreationTimeUTC Property Creation time of the file (UTC). C#
public DateTime FileCreationTimeUTC {get;}
See Also
Applies to: Video123
Video.FileModificationTimeUTC Property Modification time of the file (UTC). C#
public DateTime FileModificationTimeUTC {get;}
See Also
Applies to: Video123
Video.FileName Property File name. C#
public string FileName {get;}
See Also
Applies to: Video123
Video.FilePath Property File path. C#
public string FilePath {get;}
See Also
Applies to: Video123
125 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Video.FileSizeInBytes Property File size in bytes. C#
public long FileSizeInBytes {get;}
See Also
Applies to: Video123
Video.FileType Property Type of the video file. C#
public string FileType {get;}
See Also
Applies to: Video123
Video.KeyFrames Property Key frames of the video. Key frame is a frame, which differs significantly from previous frame. C#
public IEnumerable
126 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Example This example demonstrates usage of KeyFrames property.
public void Main() { if (CurrentCase.DataSources.Count() == 0) { return; }
DataSource dataSource = CurrentCase.DataSources.First();
if (dataSource.Videos.Count() == 0) { return; }
Video video = dataSource.Videos.First(); int count = 0;
foreach(var keyFrame in video.KeyFrames) { keyFrame.Image.Save(String.Format(@"C:\temp\keyFrame{0}.jpg", count)); count++; } }
See Also
Applies to: Video123
Video.MetaProperties Property Meta properties of the video. C#
public IEnumerable
See Also
Applies to: Video123
Video.RecognizedText Property Recognized text. C#
public string RecognizedText {get;}
127 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
See Also
Applies to: Video123
Video.Status Property Status of the video. C#
public DocumentStatus Status {get;}
See Also
Applies to: Video123
Video.TextPreview Property Text preview. C#
public string TextPreview {get;}
See Also
Applies to: Video123
CacheStatus Enumeration Status of a cache. Constant Value Description Unknown 0 No information about cache. No 1 Cache is empty. Partially 2 Some part of cache is extracted. Full 3 Cache is extracted fully.
128 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
DeviceType Enumeration Type of a data source. Constant Value Fixed 0 Removable 1 EWF 2 RAM 3 DD 4 Unsupported 5 SingleFolder 6 AFF 7 UFED 8 Hiberfil 9 Pagefile 10 LocalLogical 11 LocalPhysical 12 VDI 13 DMG 14
DocumentStatus Enumeration Document status. Constant Value Description Valid 0 These documents are completely OK and can be opened without issues. Corrupted 1 These are documents that begin with valid data but at some point are no longer readable. Invalid 2 These documents failed the consistency check completely. NotProcessed 3 These documents aren't processed yet.
DocumentTypes Enumeration Type of a document. Constant Value NotRecognized 0 Excel 1 Word 2 Access 3 Money 4 PowerPoint 5
129 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Outlook 6 OneNote 7 Mail 8 Schedule 9 Project 10 Quicken 11 QuickBooks 12 Peachtree 13 Paradox 14 QuattroPro 15 Myob 16 Filemaker 17 LotusWordPro 18 WordPerfect 19 Act 20 Acrobat 21 Lotus123 22 LotusOrganizer 23 LotusNotesId 24 LotusNotesClientId 25 Rar 26 Zip 27 MSSQL 28 ICQ 29 BestCrypt 30 Rdp 31 MsBackup 32 NortonBackup 33 MsOffice2007 34 MsOffice2010 35 Efs 36 Pgp 37 PasswordHash 40 SevenZip 41 Keychain 42 ITunesBackup 45
130 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ImportanceLevel Enumeration Importance level of a mail. Constant Value Low 0 Normal 1 High 2
MailClientType Enumeration Type of a mail client. Constant Value Outlook 1 OutlookExpress 2 TheBat 3 Thunderbird 4 WindowsLiveMail 5 AppleEmlx 6 GmailOffline 7 MimeMail 8
MessengerType Enumeration Type of an instance messenger. Constant Value IcqOld 1 Icq2003b 2 Icq4_5 3 Icq6 4 Yahoo 5 AndRq 6 Miranda 7 Qip 8 Sim 9 Skype 10 Aim 11 Msn 12 MySpace 13 Hello 14
131 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Trillian 15 QQ 16 QipInfium 17 Digsby 18 Virtus 19 MailRuAgent 20 MailRuAgent5 21 Icq6Lite 22 Skype4 23 Pidgin 24 SkypeChatSync 25 QQ2009 26 GaduGadu 27 Jabber 28 Irc 29 Qutim 30 AllMessengers 31 Xmpp 32 mIRC 33 Gajim 34 Nimbuzz 35 Em 36 Adium 37 Facebook 38 GaduGadu10 39 InstantBird 40 Fire 41 MercuryMac 42 IcqMac 43 iChat 44 YahooMac 45 Brosix 46 aMSN 47 Jitsi 48 JClaim 49 Kadu 50 xChat 51 Snak 52 Ircle 53 132 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
MailRuAgentMac 54 TrillianMac 55 ooVoo 56 TeamViewerChat 57 TeamViewer 58 KopeteLinux 59 EmeseneLinux 60 PsiLinux 61 EmpathyLinux 62 MobileDevice 63 MailRuAgent6 64 Icq8 65 AimMac 66 AimMac8 67 InstantBird1_4 68 Viber 69 MailRuAgentWin8 70 WhatsUp 71 MailRuAgent6_2 72 Icq8_2 73 IcqWin8 74 KMess 75 ooVoo3_6 76 BrosixWin 77 QipContactBackup 78 ViberWin8 79 LineWin8 80 Icq8_2MailRuAgent6_2 81 AndroidICQ5_5 82 AndroidZello 83 ChatZilla 84
ReportOrientation Enumeration Page orientation. Constant Value Horizontal 0 Vertical 1
133 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
ReportTimePeriod Enumeration Period of a report. Constant Value AllHistory 0 LastYear 1 LastMonth 2 LastWeek 3 LastDay 4 SelectedDates 5
SubfoldersStructure Enumeration Option of creation subfolders. Constant Value Description None 0 Do not create subfolder structure inside target report folder ProfilePath 1 Create subfolders according to a profile original path. CaseTree 2 Create subfolders accoring to Case Explorer structure.
TargetFormat Enumeration Target file format. Constant Value Html 0 Text 1 Xml 2 Csv 3 Pdf 4 Eml 5 Xlsx 6 Docx 7 Rtf 8
134 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
UnprotectionComplexity Enumeration Unprotection complexity of an encrypted file. Constant Value NotProtected 0 Instant 1 Fast 2 FastBruteForce 3 MediumBruteForce 4 SlowBruteForce 5 Unsupported 6
UrlType Enumeration Type of URL. Constant Value Description Internet 0 Web-page. File 1 Link to a file. Msdn 2 Msdn help article link. Javascript 3 Javascript link. Outlook 4 Outlook link. HelpCenter 5 Microsoft Help Center article link. About 6 Browser „About“ link. Cache 7 Cache link.
135 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
Index API Namespace 12 AccessCount Property {API.CacheItem} 24 CreationDateLocal Property 25 AccessCount Property {API.Cookie} 39 CreationDateUtc Property 26 AccessCount Property {API.Url} 119 CurrentCase Property 30 AccessedDateLocal Property 24 Data Property 115 AccessedDateUtc Property 24 DataSource Class 43 AddSignature Method 17 DataSources Property 30 AllConversations Property 60 Date Property 62 AllMails Property 69 Decrypted Property 75 Attaches Property 62 Description Property 31 BccAddress Property 62 DeviceType Enumeration 129 Belkasoft Api Error! Bookmark not defined. Directory Property 120 Browser Class 12 DiskType Property 44 Browsers Property 44 Document Class 47 ByteSearch Class 15 DocumentStatus Enumeration 129 ByteSearch Constructor 16 DocumentStatus Property 48 ByteSearchHit Class 17 DocumentTypes Enumeration 129 ByteSearchHit Constructor 19 Documents Property 44 ByteSearchSignature (Byte(), Byte(), Int64, String) DownloadedFile Class 51 Constructor 21 DownloadedFiles Property 14 ByteSearchSignature (Byte(), Int64, String) Constructor EMailHeader Property 63 21 Encoding Property 111 ByteSearchSignature Class 20 EncryptedFile Class 53 CacheData Property 24 EncryptedFiles Property 45 CacheFileIsCollection Property 25 EndTimeUtc Property 51 CacheFilePath Property 25 EventCategory Property 115 CacheItem Class 23 EventId Property 115 CacheItems Property 13 EventType Property 115 CacheStatus Enumeration 128 ExpireDateLocal Property 40 CacheStatus Property 25 ExpireDateUtc Property 40 Case Class 29 ExpireTime Property 120 Case Property 83 ExpiredDateLocal Property 26 Category Property 72 ExpiredDateUtc Property 26 CcAddress Property 62 ExternalFromIp Property 35 ChildrenDataSources Property 44 ExternalToIp Property 35 ClearSignaures Method 17 Favorite Class 56 Complexity Property 54 Favorites Property 14 ComputerName Property 114 FieldName Property 58 Contact Class 31 FieldValue Property 59 Contact Property 34 FileAccessTimeUTC Property {API.Document} 48 Contacts Property {API.InstantMessenger} 60 FileAccessTimeUTC Property {API.Picture} 78 Contacts Property {API.ReportOptions} 111 FileAccessTimeUTC Property {API.Video} 124 ContainsText Property 78 FileCreationTimeUTC Property {API.Document} 48 Conversation Class 33 FileCreationTimeUTC Property {API.Picture} 78 ConversationCount Property 31 FileCreationTimeUTC Property {API.Video} 125 Conversations Property 32 FileModificationTimeUTC Property {API.Document} 48 Cookie Class 38 FileModificationTimeUTC Property {API.Picture} 79 CookieKey Property 40 FileModificationTimeUTC Property {API.Video} 125 Cookies Property 14 FileName Property {API.Cookie} 41 CreatedAt Property 29 FileName Property {API.Document} 49 CreatedBy Property 29 FileName Property {API.Picture} 79 CreationDate Property 40 FileName Property {API.Video} 125
136 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
FilePath Property {API.Document} 49 Generate (IEnumerable
137 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
HttpHeaders Property {API.CacheItem} 27 Name Property {API.MetaPropertyDescription} 72 HttpHeaders Property {API.Url} 121 Name Property {API.Profile} 83 Image Property 80 Nick Property 33 ImportanceLevel Enumeration 131 Offset Property 19 ImportanceLevel Property 63 OpenAfterGeneration Property 112 InstantMessenger Class 59 OpenPassword Property 54 InstantMessengers Property 45 Output Class 72 InternalFromIp Property 35 Owner Property 61 InternalToIp Property 36 PageContent Property 122 IsDeleted Property 36 PageName Property 122 IsGroupContact Property 32 PageOrientation Property 112 IsImageUrl Method 28 Participants Property 36 IsPorn Property 81 PassPhrase Property 76 IsRootFolder Property 69 Password Class 74 KeyFrames Property 126 PasswordField Property 76 LastName Property 32 Passwords Property {API.Browser} 15 LastVisitDate Property 41 Passwords Property {API.EncryptedFile} 55 LastVisitTimeLocal Property 121 Path Property {API.DataSource} 45 LastVisitTimeUtc Property 121 Path Property {API.EncryptedFile} 55 Length Property {API.ByteSearchHit} 19 Picture Class 77 Length Property {API.ByteSearchSignature} 22 Pictures Property 46 Link Property {API.Favorite} 57 Profile Class 82 Link Property {API.TypedUrl} 118 PropertyDescription Property 71 LocalTime Property 36 PropertyType Property 72 LocationData Property 27 PropertyValue Property 71 Login Property 76 ProtectionFeatures Property 55 Mail Class 61 ReadReceipt Property 63 MailBox Class 65 Receiver Property 64 MailBoxes Property 45 RecognizedFaces Property 81 MailClientType Enumeration 131 RecognizedFacesCount Property 81 MailClientType Property {API.MailBox} 66 RecognizedText Property {API.Document} 50 MailClientType Property {API.MailFolder} 69 RecognizedText Property {API.Picture} 82 MailCount Property 69 RecognizedText Property {API.Video} 127 MailFolder Class 67 RecoveryOptions Property 55 MailFolders Property 67 RelatedFiles Property 28 Mails Property 70 Report Class 83 Md5 Property 54 ReportOptions Class 110 MessageSize Property 63 ReportOrientation Enumeration 133 MessengerType Enumeration 131 ReportTimePeriod Enumeration 133 MessengerType Property {API.Contact} 33 Secure Property 42 MessengerType Property {API.InstantMessenger} 61 SendToAddress Property 64 MetaProperties Property {API.Document} 50 Sender Property 64 MetaProperties Property {API.Picture} 81 SenderDate Property 64 MetaProperties Property {API.Video} 127 Sent Property 37 MetaProperty Class 71 ShortMessageText Method 38 MetaPropertyDescription Class 71 Signature Property 20 ModifiedDateLocal Property {API.CacheItem} 27 Size Property {API.DataSource} 46 ModifiedDateLocal Property {API.Cookie} 42 Size Property {API.DownloadedFile} 52 ModifiedDateUtc Property {API.CacheItem} 27 SortAscending Property 112 ModifiedDateUtc Property {API.Cookie} 42 SourceName Property 116 Name Property {API.ByteSearchSignature} 22 StartTimeUtc Property 52 Name Property {API.Case} 31 Status Property 128 Name Property {API.DownloadedFile} 52 Strings Property 116 Name Property {API.Favorite} 57 SubFolders Property 70 Name Property {API.MailFolder} 70 SubfoldersStructure Enumeration 134
138 Created by Belkasoft team.
BELKASOFT EVIDENCE CENTER 2015 SCRIPTING API REFERENCE
SubfoldersStructure Property 112 Subject Property 65 SyncDateLocal Property 28 SyncDateUtc Property 28 SyncTime Property 122 SystemEventLog Class 113 SystemEventLogs Property 46 Target Property 52 TargetFile Property 113 TargetFormat Enumeration 134 Text Property {API.Conversation} 37 Text Property {API.Mail} 65 Text Property {API.SystemEventLog} 116 TextPreview Property {API.Document} 50 TextPreview Property {API.Picture} 82 TextPreview Property {API.Video} 128 TimePeriod Property 113 To Property 113 ToUin Property 37 Topic Property 65 TotalMailCount Property 70 TypeDetails Property 56 TypedUrl Class 117 TypedUrls Property 15 Uin Property {API.Contact} 33 Uin Property {API.Conversation} 37 UnprotectionComplexity Enumeration 135 Url Class 118 UrlFile Property 122 UrlType Enumeration 135 UrlType Property 123 Urls Property 15 UserName Property {API.Cookie} 42 UserName Property {API.Url} 123 UserNameField Property 77 UserSid Property 116 UtcTime Property 38 Value Property 43 Video Class 123 Videos Property 46 Width Property 82 WriteLine Method 73 WriteLine (String) Method 73 WriteLine (String, Object()) Method 74 WrittenTimeUtc Property 117
139 Created by Belkasoft team.