Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
/div>

Hash List Importer

This EnScript is designed to read a text file containing one or more hash items and write them into a user-nominated hash-set in a new hash-library, or into a sorted binary file (see the script's internal help-text for more details regarding this option).

If the standard import-option is chosen then the import-file must have four fields without a header row -

  • Name
  • Logical Size
  • MD5-Hash
  • SHA-1 Hash

The name or logical size fields may be left empty but if the hash-library output-option has been chosen then either or both of the MD-5 and SHA-1 fields must contain a value, which should be 16 or 20 bytes (32 or 40 characters) in length respectively. If the option to output to a binary file has been chosen then the MD-5 hash-value must be present (the SHA-1 hash-value won't be used).

If the NSRL import option is chosen then the script will require the import-file to be called 'NSRLFile.txt'. This file should have the following eight fields together with the standard NSRL header-row -

  • SHA-1
  • MD5
  • CRC32
  • FileName
  • FileSize
  • ProductCode
  • OpSystemCode
  • SpecialCode

Both input files should have Windows carriage-return, line-feed endings (\x0d\x0a).

If the hash-library output-option has been taken then the script will only use the fields from the NSRL-format file that contain the file-name, file-size, MD-5 and SHA-1 values. The examiner is required to specify an empty folder into which the resultant library will be written, and also the name and category of the single hash-set which will house the newly-imported items.

Once the hash-library has been created, the examiner can use the Hash Libraries option on the EnCase Case menu to set the new hash library as the current case's primary or secondary library. It's also possible to use the Manage Hash Library option on the Tools menu in order to import the hash-set from the newly created library into another library.

Please be warned that it's not possible to remove a hash-set once it's been added to a hash-library. To get around this, one would need to create a new library and then import the desired hash-sets from the old library into the new one.

A YouTube video demonstrating how to use this script is available from the following URL -

Download Now

Download Now



Version: 3.0.0
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Utility