EnCase - enosxintel version, Extension Attribute

jhalvorson
Valued Contributor

Between version 7.10.x and 7.12.x, the location the binary has changed. Current versions install in /usr/local/sbin and prior versions installed in /usr/sbin

This EA script will report on the version for either location. It's based on a prior EA available from JAMFNATION.

#!/bin/bash

# REFERENCES:
# https://jamfnation.jamfsoftware.com/viewProductFile.html?fid=800

# Depending on the version installed, the binary could be in either /usr/local/sbin or /usr/sbin


 if [[ -e "/usr/local/sbin/enosxintel" ]]; then
    encaseVersion=$(/usr/local/sbin/enosxintel -help 2> /dev/null | grep enosxintel | head -1 | awk '{print $2}')
 elif [[ -e "/usr/sbin/enosxintel" ]]; then
    encaseVersion=$(/usr/sbin/enosxintel -help 2> /dev/null | grep enosxintel | head -1 | awk '{print $2}')
 elif [[ ! -e "/usr/local/sbin/enosxintel" ]] && [[ ! -e "/usr/sbin/enosxintel" ]]; then
    encaseVersion=Not Installed
 fi

echo "<result>$encaseVersion</result>"
0 REPLIES 0