Encase hash files
From Forensics Wiki
Revision as of 10:37, 27 February 2007 by Jessek
Encase hash files are different from version 3 to versions 4 and 5. Both versions start with the header, in hexadecimal:
48 41 53 48 0d 0a ff 00
In ASCII, this looks like HASH followed by a newline.
The hashes begin at offset 0x480 in the file.