Recipe Difficulty: Medium

Python Version: 2.7 or 3.5

Operating System: Windows

The embedded metadata extracting recipes we have designed work against loose files, not with files found within a forensic image. Annoyingly, this adds an extra step in our process, requiring us to export the files of interest from the image for this type of review. We show in this recipe, how to connect our scripts to a forensic tool, EnCase, and execute them without needing to export the files from a forensic image.