Create Hash Library From Multiple Hash Lists
This script is designed to create/update a hash library using the hash-values contained in one or more tab-delimited hash-list files with CR/LF line-endings.
The contents of each file will be written into a separate hash-set with the name and category specified by the user.
The list of hash-list files can be exported to a tab-delimited file for later use. The import option associated with this feature can also be used to import a list of hash-list files created by another application, Excel for instance.
Each hash-list file must have the following fields without a header-row:
- Name
- Logical Size
- MD5-Hash
- SHA-1 Hash
Notwithstanding that the name or logical-size fields may be left empty, one or both of the MD-5 and SHA-1 fields must contain a valid hash of the appropriate type.
With regards to the logical-size field, the script will automatically strip any surrounding double-quotes as well as any comma, period, space, or thin-space separator-characters.
Sample hash-list files have been included with this script.
The script does not support importing hash values from more than one file into the same hash-set. To accomplish this, concatenate the hash-list files first.
Once the hash-library has been created, the examiner can use the Hash Libraries option on the EnCase Case menu to set the new hash library as the current case's primary or secondary library. It's also possible to use the Manage Hash Library option on the Tools menu in order to import the hash-set from the newly created library into another library.
It's important to note that it's not possible to remove a hash-set once it's been added to a hash-library. To overcome this, it's necessary to import the desired hash-set(s) into a new library whilst excluding the remainder.
This script does not support importing NSRL hash-sets. Use the Hash-List importer EnScript for this purpose.
For additional information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now