The steps outlined below will populate the Hash Set and Hash Category columns of the Table pane in EnCase.

  1. With your evidence loaded in EnCase, click Search.

  2. Place a check in the box for "Compute hash value" and make sure everthing else is unchecked, then click "Start".
  3. After the Search function completes, click "View" then click "Hash Sets".
  4. Select the Hash Set(s) of interest in the Table pane.
  5. Right-click in the Table pane and select Rebuild Library.
  6. When EnCase finishes rebuilding the library, click OK.

  7. Click View the Cases to return to the Case View.

Tratto da: https://support.guidancesoftware.com/node/136

Forensics/Encase/Hashing (last edited 2010-05-17 14:13:26 by Kurgan)