Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Hash List Importer

This EnScript is designed to read a text file containing one or more hash items and write them into a user-nominated hash-set in a new hash-library, or into a sorted binary file (see the script's internal help-text for more details regarding this option).

If the standard import-option is chosen then the import-file must have four fields without a header row -

  • Name
  • Logical Size
  • MD5-Hash
  • SHA-1 Hash

The name or logical size fields may be left empty but if the hash-library output-option has been chosen then either or both of the MD-5 and SHA-1 fields must contain a value, which should be 16 or 20 bytes (32 or 40 characters) in length respectively. If the option to output to a binary file has been chosen then the MD-5 hash-value must be present (the SHA-1 hash-value won't be used).

If the NSRL import option is chosen then the script will require the import-file to be called 'NSRLFile.txt'. This file should have the following eight fields together with the standard NSRL header-row -

  • SHA-1
  • MD5
  • CRC32
  • FileName
  • FileSize
  • ProductCode
  • OpSystemCode
  • SpecialCode

Both input files should have Windows carriage-return, line-feed endings (\x0d\x0a).

If the hash-library output-option has been taken then the script will only use the fields from the NSRL-format file that contain the file-name, file-size, MD-5 and SHA-1 values. The examiner is required to specify an empty folder into which the resultant library will be written, and also the name and category of the single hash-set which will house the newly-imported items.

Once the hash-library has been created, the examiner can use the Hash Libraries option on the EnCase Case menu to set the new hash library as the current case's primary or secondary library. It's also possible to use the Manage Hash Library option on the Tools menu in order to import the hash-set from the newly created library into another library.

Please be warned that it's not possible to remove a hash-set once it's been added to a hash-library. To get around this, one would need to create a new library and then import the desired hash-sets from the old library into the new one.

A YouTube video demonstrating how to use this script is available from the following URL -

Download Now



Version: 3.0.0
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Utility

13553 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
234 Downloads
App
Utility

View SQLite With WAL Plugin

Allows SQLite database files to be opened in conjunction with any write-ahead log (WAL) file.
By Simon Key
140 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
98 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
72 Downloads
App