The steps outlined below will populate the Hash Set and Hash Category columns of the Table pane in EnCase.
With your evidence loaded in EnCase, click Search.
- Place a check in the box for "Compute hash value" and make sure everthing else is unchecked, then click "Start".
- After the Search function completes, click "View" then click "Hash Sets".
- Select the Hash Set(s) of interest in the Table pane.
- Right-click in the Table pane and select Rebuild Library.
When EnCase finishes rebuilding the library, click OK.
- Click View the Cases to return to the Case View.