EnScript v7 - issue...
 
Notifications
Clear all

EnScript v7 - issues with getting MD5 hash value - HELP?

5 Posts
3 Users
0 Likes
391 Views
christinamather
(@christinamather)
Posts: 3
New Member
Topic starter
 

I am creating an EnScript in EnCase version 7 as part of my university final year project.
I am exporting file metadata for chosen files types however; upon testing I have come across an issue.

I am extracting a variety of metadata including filesnames, file extensions and MD5 values etc.
The methods to get these are;
entry.Name();
entry.Extension();
entry.HashValue();

When running the script on an Lx01 image; all values are found for each entry.
When running the script on an E01, Ex01 or DD image; values are found for file name and for file extension but NOT hash value; the evidence pane shows MD5 values for each entry - so it seems as though there is no logical reasoning behind it not working?

Can anyone advise me why this is the case or how to go about resolving this?

Thanks in advance, Christina.

 
Posted : 10/03/2014 2:28 am
(@mansiu)
Posts: 83
Trusted Member
 

have you run hash analysis(hashing) before running your enscript on the E01?

 
Posted : 10/03/2014 1:59 pm
christinamather
(@christinamather)
Posts: 3
New Member
Topic starter
 

Hi Yes I ran "compute hash and file sig analysis"; the evidence pane shows MD5 values for all entries upon completion of this. This is why I can't understand why its not working.

 
Posted : 10/03/2014 2:17 pm
Chris_Ed
(@chris_ed)
Posts: 314
Reputable Member
 

Can you post your code? It does seem like odd behaviour.

 
Posted : 11/03/2014 1:19 pm
christinamather
(@christinamather)
Posts: 3
New Member
Topic starter
 

Thank you for your reply!

I've now had an answer via the Guidance software forum.

The method has to be entry.HashValue().GetString() for it to work with the other two images. The previous method was apparently getting a hash object - just strange it worked with the L01 image.

 
Posted : 12/03/2014 2:45 am
Share: