Difference between revisions of "Encase hash files"

From ForensicsWiki
Jump to: navigation, search
m
(Cleaned up and added detail for hash start)
Line 1: Line 1:
 
{{Expand}}
 
{{Expand}}
  
'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.
+
'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header, in hexadecimal:
 +
 
 +
<pre>48 41 53 48 0d 0a ff 00</pre>
 +
 
 +
In ASCII, this looks like <tt>HASH</tt> followed by a newline.
 +
 
 +
The hashes begin at offset 0x480 in the file.  
  
 
== See also ==
 
== See also ==
  
 
* [[EnCase]]
 
* [[EnCase]]

Revision as of 11:37, 27 February 2007

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Encase hash files are different from version 3 to versions 4 and 5. Both versions start with the header, in hexadecimal:

48 41 53 48 0d 0a ff 00

In ASCII, this looks like HASH followed by a newline.

The hashes begin at offset 0x480 in the file.

See also