Litigation Support Tip of the Night
top of page

Too busy with preparing for a hot seat electronic presentation right now to post anything of great detail, but note that my recent experiences indicate that if you receive a Windows Error 0x8007045D, when copying data to an external hard drive, a likely cause is plugging the drive into a UBS hub, rather than a port on your laptop, or simply a loose connection.




19 views0 comments

If you're curious as to whether or not a forensic examination of a computer can determine if

folders were renamed or deleted, or even simply accessed on a device inquire about the possibility of analyzing shellbags. Shellbags are stored in a file named UserClass.dat in the Windows Registry . The timestamps and other data are encoded in hexadecimal - the numbering system employed by developers that uses 16 symbols (0-9 and A-F) rather than the standard decimal system.


Companies such as Privazer have applications which cannot only display last accessed and modified times for directories which are stored in shellbags but also erase that data as well.


Shellbag data is hard to remove. A new folder or zip file which is created in place of an old one with the same name will inherit its shellbag data. Opening a folder, copying a folder, renaming a folder, deleting a folder, or even simply selecting or right clicking on a folder will generate shellbag data.

30 views0 comments

It's not so easy to export data from Excel to a load file with a quote qualifier and comma delimiter - the format required by many applications. Saving the file in the .csv format will omit the quotation marks:




. . . it's a pain to accurately add in the missing quotation marks by altering the file in a text editor, and Excel doesn't provide an easy way to add them in the export. Luckily, Microsoft has posted a macro here, which will export data from an Excel spreadsheet in the correct format.



Enter the below code in a module for the worksheet with the data:



Select the data on the worksheet that you want to export to a new file. Run the macro and it will prompt you to enter a path for the new file:




A new file with comma delimiters and quotation mark qualifiers appears:



This is the complete code but it is not formatted correctly so use the code at this link or edit the code before running it.


Sub QuoteCommaExport()

' Dimension all variables.

Dim DestFile As String

Dim FileNum As Integer

Dim ColumnCount As Long

Dim RowCount As Long

' Prompt user for destination file name.

DestFile = InputBox("Enter the destination filename" _

& Chr(10) & "(with complete path):", "Quote-Comma Exporter")

' Obtain next free file handle number.

FileNum = FreeFile()

' Turn error checking off.

On Error Resume Next

' Attempt to open destination file for output.

Open DestFile For Output As #FileNum

' If an error occurs report it and end.

If Err <> 0 Then

MsgBox "Cannot open filename " & DestFile

End

End If

' Turn error checking on.

On Error GoTo 0

' Loop for each row in selection.

For RowCount = 1 To Selection.Rows.Count

' Loop for each column in selection.

For ColumnCount = 1 To Selection.Columns.Count

' Write current cell's text to file with quotation marks.

Print #FileNum, """" & Selection.Cells(RowCount, _

ColumnCount).Text & """";

' Check if cell is in last column.

If ColumnCount = Selection.Columns.Count Then

' If so, then write a blank line.

Print #FileNum,

Else

' Otherwise, write a comma.

Print #FileNum, ",";

End If

' Start next iteration of ColumnCount loop.

Next ColumnCount

' Start next iteration of RowCount loop.

Next RowCount

' Close destination file.

Close #FileNum

End Sub

56 views0 comments
bottom of page