EnCase hash map - Revision history

Jsummers: Updating Forensics Wiki links

2023-09-02T13:24:42Z

Updating Forensics Wiki links

Mark0: Updated Forensicswiki Links

2020-06-01T16:17:20Z

Updated Forensicswiki Links

Dan Tobias: /* Links */

2015-06-05T03:11:25Z

‎Links

Dan Tobias: Created page with "{{FormatInfo |formattype=electronic |subcat=Forensics and Law Enforcement }} The '''EnCase hash map''' is used by the Encase forensic software (early versions are known as..."

2013-10-19T15:49:02Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Forensics and Law Enforcement }} The '''EnCase hash map''' is used by the Encase forensic software (early versions are known as..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Forensics and Law Enforcement
}}
The '''[[EnCase hash map]]''' is used by the Encase forensic software (early versions are known as Expert Witness) to store hash tables of data stored for the purpose of investigation, such as files and disk images taken from suspect hard drives.

== File identification ==

The file begins with the hex header <code>45 4e 4d 41 50 20 56 34 0b 00 00 00</code>, which spells <code>ENMAP V4</code> in ASCII. (That's presumably for version 4; other versions may differ.)

== Format ==

The [[MD5]] hash format is used. A hash of the entire file is stored, followed by three zero bytes and then piecewise file-part hashes. The entire-file hash is preceded by the header given above, then the original filename in Unicode.

== Links ==
* [http://www.forensicswiki.org/wiki/Encase_hash_map Forensics wiki page on hash map]
* [http://www.forensicswiki.org/wiki/EnCase Forensics wiki page on EnCase]
* [http://clientui-kb.symantec.com/resources/sites/BUSINESS/content/live/TECHNICAL_SOLUTION/136000/TECH136997/en_US/358082.pdf EnCase Ingest Connector Implementation Guide]
* [http://www.evolvediscovery.com/technology/encase_forensics.php EnCase forensics description]

@@ Line 3: / Line 3: @@
 |subcat=Forensics and Law Enforcement
 }}
-The '''[[EnCase hash map]]''' is used by the Encase forensic software (early versions are known as Expert Witness) to store hash tables of data stored for the purpose of investigation, such as files and disk images taken from suspect hard drives.
+The '''EnCase hash map''' is used by the Encase forensic software (early versions are known as Expert Witness) to store hash tables of data stored for the purpose of investigation, such as files and disk images taken from suspect hard drives.
 == File identification ==
@@ Line 14: / Line 14: @@
 == Links ==
-* [https://forensicswiki.xyz/wiki/index.php?title=Encase_hash_map Forensics wiki page on hash map]
+* [{{ForensicsWikiURL|encase_hash_map}} Forensics wiki page on hash map]
-* [https://forensicswiki.xyz/wiki/index.php?title=EnCase Forensics wiki page on EnCase]
+* [{{ForensicsWikiURL|encase}} Forensics wiki page on EnCase]
 * [http://clientui-kb.symantec.com/resources/sites/BUSINESS/content/live/TECHNICAL_SOLUTION/136000/TECH136997/en_US/358082.pdf EnCase Ingest Connector Implementation Guide]
 * [http://www.evolvediscovery.com/technology/encase_forensics.php EnCase forensics description]
 * [https://github.com/volatilityfoundation/volatility/wiki/EWF-Address-Space EWF Address Space]

← Older revision		Revision as of 03:11, 5 June 2015
Line 18:		Line 18:
	* [http://clientui-kb.symantec.com/resources/sites/BUSINESS/content/live/TECHNICAL_SOLUTION/136000/TECH136997/en_US/358082.pdf EnCase Ingest Connector Implementation Guide]		* [http://clientui-kb.symantec.com/resources/sites/BUSINESS/content/live/TECHNICAL_SOLUTION/136000/TECH136997/en_US/358082.pdf EnCase Ingest Connector Implementation Guide]
	* [http://www.evolvediscovery.com/technology/encase_forensics.php EnCase forensics description]		* [http://www.evolvediscovery.com/technology/encase_forensics.php EnCase forensics description]
		+	* [https://github.com/volatilityfoundation/volatility/wiki/EWF-Address-Space EWF Address Space]