We have just installed FTK 5.1. I am trying to use my library of hash values to help in my cases. These are all hash sets of notable images from various LE agencies and are all in the .hash format. The book says FTK can accept .hash files, but when I called tech support, I was informed they do not support this in v5. From my understanding, previous versions of FTK would allow imports of .hash files, but that has gone away with v5. I have scoured message boards and cannot find a conversion program to turn my .hash files into a .csv, or any other format FTK recognizes. We have another box here with FTK v1 installed. I can import these .hash files to that program easily (it's amazing, they have a button just for .hash files). I have heard there is an export function on previous versions of FTK, but am unable to find it on this version (the menu are radically different from v5. We also use IEF, which can now hash, but they only accept csv format as well. I was informed simply changing the extension of the hash file will have no effect. How can I use my hash sets with FTK? I do have access to EnCasev7 as well, I hear there is an export function on there, but have not been able to simply click an export and shoot them to a csv.
Thank you
http//www.forensicfocus.com/Forums/viewtopic/t=2781/
You may wish to PM jcas1411 from that thread as a few years ago he apparently wrote a script for converting .hash to .csv and vice versa )
Also 😉
https://
.hash files are EnCase specific but they're pretty easy to convert if you have access to EnCase v6
For v6, simply click view, then hash sets and your hash set should be listed in there as long as it's placed in the proper folder, then select "Hash Items" which will give you a listing of the all the hashes in that list. Finally, right click the hashes and select Export. From this screen you can select the output format (CSV if you wish, IEF accepts the line separated Text format) and the fields you want to export (I would suggest only including the "Hash" field to ensure your new hash set is compatible with as many other tools as possible). Select Finish and you should be good to go.
For v7, Guidance really changed everything around. The .hash files are no longer supported (only as "legacy" sets) and they now use .bin files to store everything. I still haven't found a way to export to CSV or txt so if anyone else has please let the group know.
Jesse Kornblum wrote a script here (http//
Thanks,
Jamie
Thank you. Luckily I have access to a machine with EnCase v6. I was able to export them and their sitting in IEF now. FTK seems a little slower than it should on the import, but hopefully they will be in there by morning.