Encase hash files - Revision history

Joachim Metz at 19:19, 17 December 2010

2010-12-17T19:19:54Z

2010-12-01T12:36:22Z

2008-05-29T12:20:14Z

Reworded to be more clear

2008-01-25T15:28:58Z

2007-04-08T12:10:10Z

Added category

2007-02-27T16:47:48Z

2007-02-27T16:37:43Z

Cleaned up and added detail for hash start

2007-02-27T15:26:08Z

2006-03-24T04:30:22Z

EncaseHashFiles moved to Encase hash files

2006-03-24T04:28:46Z

← Older revision		Revision as of 19:19, 17 December 2010
Line 64:		Line 64:
	* [[EnCase]]		* [[EnCase]]

−	[[Category:Forensics File ~~Format~~]]	+	[[Category:Forensics File Formats]]

← Older revision		Revision as of 12:36, 1 December 2010
Line 26:		Line 26:
	'''Offset 0x0014'''		'''Offset 0x0014'''

−	The range from 0x0014 to ~~0x0457~~ is filled by zero-bytes. The purpose of this area is unknown.	+	The range from 0x0014 to 0x0407 is filled by zero-bytes. The purpose of this area is unknown.

		+
		+
		+	'''Offset 0x0408'''
		+
		+	HashSet: The text that EnCase shows in its column "Hash Set". The maximum string length is 39 characters. Characters are stored in Unicode. (''Based on hash file form EnCase v. 6.17'')

@@ Line 1: / Line 1: @@
 {{Expand}}
-Although [[EnCase]] can import a variety of [[MD5]] hash file formats, it uses a proprietary format to store its hashes. [[Metadata]] is stored at the hash set level. That is, individual hashes do not contain any information specific to them, but the set as a whole can contain some information. No filenames are stored with the hashsets.
+The [[EnCase]] forensics suite uses a proprietary file format to store sets of known hashes called the '''EnCase hash file format'''. The format stores a set of [[MD5]] hashes and [[metadata]] about the set as a whole. That is, individual hashes do not contain any information specific to them, but the set as a whole can contain some information. In particular, the filename corresponding to each hash is not stored.
 Version 3 of [[EnCase]] used a slightly different format than versions 4 and 5. Both versions start with the header, in hexadecimal:
@@ Line 10: / Line 10: @@
 The hashes begin at offset 0x480 in the file.
 A quick look at a hash file created by Encase 6.8.1.8 revealed the following structure (to be verified):
 '''Offset 0x0000 '''
@@ Line 21: / Line 17: @@
 A header that consists of the following 16 bytes:
 <pre>48 41 53 48 0D 0A FF 00 02 00 00 00 01 00 00 00</pre>
 '''Offset 0x0010'''

@@ Line 3: / Line 3: @@
 Although [[EnCase]] can import a variety of [[MD5]] hash file formats, it uses a proprietary format to store its hashes. [[Metadata]] is stored at the hash set level. That is, individual hashes do not contain any information specific to them, but the set as a whole can contain some information. No filenames are stored with the hashsets.
-Version 3 of [[EnCase]] used a slightly different format than versions 4 and 5. The format for version 6 is not known. Both versions start with the header, in hexadecimal:
+Version 3 of [[EnCase]] used a slightly different format than versions 4 and 5. Both versions start with the header, in hexadecimal:
 <pre>48 41 53 48 0d 0a ff 00</pre>
@@ Line 9: / Line 9: @@
 In ASCII, this looks like <tt>HASH</tt> followed by a newline.
 The hashes begin at offset 0x480 in the file.
 == See also ==

← Older revision		Revision as of 12:10, 8 April 2007
Line 14:		Line 14:

	* [[EnCase]]		* [[EnCase]]
		+
		+	[[Category:Forensics File Format]]

← Older revision		Revision as of 15:26, 27 February 2007
Line 1:		Line 1:
		+	{{Expand}}
		+
	'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.		'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.

← Older revision		Revision as of 04:28, 24 March 2006
Line 1:		Line 1:
−	Encase hash files are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.	+	'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.
		+
		+	== See also ==
		+
		+	* [[EnCase]]