EnCase Hash compari...
 
Notifications
Clear all

EnCase Hash comparing  

  RSS
chriskincaid
(@chriskincaid)
New Member

Probable super simple to some of you. But it's not for me.

I have two cases; say case A and B. Both have been processed and hashes analyzed.
I selected all of the hashed files in case A and created a hash set and placed it in a hash library.

Now I would like to compare the hash set/library to all of the hashes in case B. Everyone acts like it is easy, but I don't see any compare hashes button, and can't find any material which goes through the steps. Actually, I found a couple, which refer to EnScripts which my EnCase 7.12.01 (Training Version) does not have.

Please help.

Quote
Posted : 28/10/2018 8:02 pm
chriskincaid
(@chriskincaid)
New Member

I figured it out.

Going to post a reply to my own question for anyone in the future looking through threads for how to match hashes.

Once you build the hash set(s), there is a filter in which you can filter for the category/categories you created when making the hash set. Once I found that the rest was easy.

ReplyQuote
Posted : 29/10/2018 12:34 am
Share: