Encase hash files

From ForensicsWiki
Revision as of 16:37, 27 February 2007 by Jessek (Talk | contribs) (Cleaned up and added detail for hash start)

Jump to: navigation, search

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Encase hash files are different from version 3 to versions 4 and 5. Both versions start with the header, in hexadecimal:

48 41 53 48 0d 0a ff 00

In ASCII, this looks like HASH followed by a newline.

The hashes begin at offset 0x480 in the file.

See also