| <<< Advanced: Removing Recovered Partition | Index | Hash Library Hierarchy >>> |
EnCase allows to build a library of hash sets.
EnCase uses MD5 hash algorithm to compute unique fingerprints for particular files. Copies of the same file will have the same MD5 value.
For example,
OS Files: a hash set for well known operating system files can be built to separate operating system components from the user's applications and data.
Contraband Files: known CP images hash set can be built to check disk drives if they contain contraband files.
Unathorized Applications: a hash set for an application known to be used for illegal purposes (e.g. copying cell phone SIM cards) can be created.
Unathorized Files: an organization computer use policy may require that the employees do not install unathorized software on corporate computers, including laptops.
| <<< Advanced: Removing Recovered Partition | Index | Hash Library Hierarchy >>> |