Im trying to rebuild a hash library (v.6) and when I right click the selected hash sets then click 'rebuild library' I get this error
Error Cannot delete output file 'C\Program Files\EnCase6.13\encase.Hash'
Any ideas?
Thanks in advance
Are you running EnCase on Windows Vista or 7? If so, are you running EnCase as an Administrator, or with UAC disabled?
HTH
Ben
I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.
Tom
I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.
Tom
"The software is functioning as designed."
don't get me started.
The "encase.hash" file seems to be relatively recent (by which I mean, within the last two years). I believe what it's doing is joining the hashes from the currently selected sets (removing duplicates) and putting them on disk as opposed to keeping them in memory. All well and good for if you have lots of hash sets loaded.
The problem is that it's extraordinarily common for examiners to run multiple instances of EnCase simultaneously. Having a single, modifiable file shared amongst multiple instances, all doing different things, is… bad.
The irony is that each EnCase instance will create its own unique "console" file, for backing the console view in EnCase. You can see these in the EnCase\Temp folder console-1.txt, console-2.txt, etc. The previous limit on the number of instances you could run at a time was 6, because EnCase will roll back over to console-1.txt at that point. Then you get a sharing violation error when you open up EnCase.
This leads to two interesting questions
1. If per-instance files can be used for the console, why not for the hash library?
2. Why is the limit on consoles "6"?
Jon
This is a known issue with EnCase v6 and an "Enhancement request" has been submitted on their support forums. You can not use hash sets with multiple instances of EnCase open. I highly doubt this will change in V6 since V7 is due out next year sometime.
Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.
Best regards,
Tony
Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.
Hi Tony,
I completely agree with you; I think you misread my post. I said it's "extraordinarily common" for folks to have multiple instances running, for the reasons you note. It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.
Jon
Hi Tony,
I completely agree with you; I think you misread my post. I said it's "extraordinarily common" for folks to have multiple instances running, for the reasons you note. It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.
Jon
Sorry Jon, you are correct and yes, it is one of many frustrating problems associated with EnCase.
Hope all is well,
Tony
It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.
Jon
Exactly, I'd guess it's as simple as keeping better control of file handles.
FWIW
Using 'Unlocker' to close the file handle for the encase.hash file (in the prog files\encase folder) seems to do the trick with no apparent nasty side affects.
(no guarantees - test first on non production environment of course)