ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
Encase hash map
The EnCase suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not available. This data is stored in a file with a .EnMap extension and contains piecewise MD5 hashes of the file. Each EnMap file has the following format:
The file has an ASCII header, ENMAP V4, or in hex 45 4e 4d 41 50 20 56 34 0b 00 00 00.
This is followed by a Unicode representation of the original filename.
There is then an MD5 hash of the entire file. This hash is followed by three bytes of zeros, and then a hexadecimal representation of each piecewise hash.
Many computer forensic programs, especially the all-in-one suites, use their own file formats to store information.