Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

FileHash2SQLite

FileHash2SQLite will take a tagged set of files and export their MD5 hash values to a SQLite database. The user is presented with an option to use an existing database or create a new. The user will then select or enter the database file name. Lastly, the user will select the tag(s) for matching files. The resulting database has four columns: id, casenum, examiner and hash.

The database collects hash values of notable files (typically malware) and their associated Case Numbers and Examiners. Users can then find previous cases with matching files by searching for a notable hash value.

The SQLite database can be queried using the sqlite3 command line utility with a command line session similar to the one shown below.

C:\>sqlite3 casehashes.sqlite SQLite version 3.8.6 2014-08-15 11:46:33 Enter ".help" for usage hints. sqlite> select * from hashes where hash='2151D58EEBC3A051529C010A548C8953'; 6|ABC123456-01|Dick Jones|2151D58EEBC3A051529C010A548C8953'

Download Now



Version: 1
Tested with:
EnCase Forensic 7.1
Developer: Greg Farnham
Category: Utility

2896 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
348 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
177 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
154 Downloads
App
Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
88 Downloads
App