Using WinRAR to capture Logical Files

Recently I have been experimenting with using WinRAR as a replacement file container for EnCase Logical Evidence Files (LEF) when in Windows. In OSX and Linux I use TAR.

My main reason is that not all other products and utilities can read LEF files and in my current role we need a method to capture files into a container file that preserves ownership, permissions and date and time information.

I therefore created a small batch file that will capture the contents of the current directory into a RAR file. I use either FTK Imager or EnCase to mount the evidence files and then use WinRAR to create the container file. You need to download and the Command-line version of WinRAR for the rar.exe executable.

To fully understand the rar switches please refer to the help file.

The contents of the batch file are;


@echo off
echo This script will capture all files and folders in the current directory to a locked RAR file
echo ****WARNING ENSURE ALL FILE PATHS ARE CORRECT****
set /p _name="Enter the location of the WinRar Folder On Your e.g. C:\winrar
set path=%_name%;%path%
set /p _evidence=Enter the evidence file name and full path to the storage location e.g. D:\evidence.rar:
set /p _logfile=Enter the log file name and full path name e.g. D:\error.log:
rar a %_evidence% -r -ri1 -mt2 -ag[yyyy-dd-mm] -m5 -os -ow -tk -tsm4 -tsc4 -tsa4 -k -ilog %logfile%
echo All data in this folder has been captured into a locked rar file called %_evidence%

On completion you should have a RAR file of the target files with all the date and timestamps, permissions and ownership information preserved.