35. Hash Library Building Steps

1. Search -> check Compute hash value. This generates MD5 fingerprints for all allocated files.

2. Select (blue-check) files to be included in a hash set. Right-click in the table view area and click Create Hash Set...

   • NOTES:

     • Some directories (e.g. on FAT volumes) will have logical size zero and will be excluded from the hash set.

     • On NTFS, directories maintain logical size; therefore, they will be included in the hash set.

3. Specify hash set name and category.

   • NOTE: Hash sets are inactive until (1) they are selected, and (2) the hash library is rebuilt!

4. View -> Hash Sets -> Select (blue-check) desired sets -> right-click in the table view area and click Rebuid Library...

5. The Library is shared between cases. Click Search -> check Compute hash value and execute this on any blue-check-selected files that you wish to analyze. Use Selected items only option in the search box as necessary.

6. As a result of the search, the hash values, hash set names, and hash set category columns are indicated in the table view pane of the allocated files. Use green home plate selection to flatten the view as necessary.

7. Follow Lesson 15, page 157 of EnCase Student's guide to learn how to apply filters on computed hash sets and how to document the findings.