Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Hash List Importer

This EnScript is designed to read a text file containing one or more hash items and write them into a user-nominated hash-set in a new hash-library, or into a sorted binary file (see the script's internal help-text for more details regarding this option).

If the standard import-option is chosen then the import-file must have four fields without a header row -

  • Name
  • Logical Size
  • MD5-Hash
  • SHA-1 Hash

The name or logical size fields may be left empty but if the hash-library output-option has been chosen then either or both of the MD-5 and SHA-1 fields must contain a value, which should be 16 or 20 bytes (32 or 40 characters) in length respectively. If the option to output to a binary file has been chosen then the MD-5 hash-value must be present (the SHA-1 hash-value won't be used).

If the NSRL import option is chosen then the script will require the import-file to be called 'NSRLFile.txt'. This file should have the following eight fields together with the standard NSRL header-row -

  • SHA-1
  • MD5
  • CRC32
  • FileName
  • FileSize
  • ProductCode
  • OpSystemCode
  • SpecialCode

Both input files should have Windows carriage-return, line-feed endings (\x0d\x0a).

If the hash-library output-option has been taken then the script will only use the fields from the NSRL-format file that contain the file-name, file-size, MD-5 and SHA-1 values. The examiner is required to specify an empty folder into which the resultant library will be written, and also the name and category of the single hash-set which will house the newly-imported items.

Once the hash-library has been created, the examiner can use the Hash Libraries option on the EnCase Case menu to set the new hash library as the current case's primary or secondary library. It's also possible to use the Manage Hash Library option on the Tools menu in order to import the hash-set from the newly created library into another library.

Please be warned that it's not possible to remove a hash-set once it's been added to a hash-library. To get around this, one would need to create a new library and then import the desired hash-sets from the old library into the new one.

A YouTube video demonstrating how to use this script is available from the following URL -

Download Now



Version: 3.0.0
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Utility

5980 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
590 Downloads
App
Utility

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key
232 Downloads
App
Utility

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key
230 Downloads
App
Utility

Microsoft Word ASD Document Viewer

This EnScript plugin allows Autosave Document (ASD) files to be extracted and opened with Microsoft Word.
By Simon Key
183 Downloads
App