Jessek: Created page with "{{wikify}} {{expand}} The EnCase suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not availabl..."

2010-11-01T21:29:17Z

Created page with "{{wikify}} {{expand}} The EnCase suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not availabl..."

New page

{{wikify}}
{{expand}}

The [[EnCase]] suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not available. This data is stored in a file with a .EnMap extension and contains piecewise [[MD5]] hashes of the file. Each EnMap file has the following format:

The file has an ASCII header, ENMAP V4, or in hex 45 4e 4d 41 50 20 56 34 0b 00 00 00.

This is followed by a Unicode representation of the original filename.

There is then an [[MD5]] hash of the entire file. This hash is followed by three bytes of zeros, and then a hexadecimal representation of each piecewise hash.

{{Category:Forensics File Format}}

Encase hash map - Revision history

Jessek: Created page with "{{wikify}} {{expand}} The EnCase suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not availabl..."