I am creating an EnScript in EnCase version 7 as part of my university final year project.
I am exporting file metadata for chosen files types however; upon testing I have come across an issue.
I am extracting a variety of metadata including filesnames, file extensions and MD5 values etc.
The methods to get these are;
entry.Name();
entry.Extension();
entry.HashValue();
When running the script on an Lx01 image; all values are found for each entry.
When running the script on an E01, Ex01 or DD image; values are found for file name and for file extension but NOT hash value; the evidence pane shows MD5 values for each entry - so it seems as though there is no logical reasoning behind it not working?
Can anyone advise me why this is the case or how to go about resolving this?
Thanks in advance, Christina.
have you run hash analysis(hashing) before running your enscript on the E01?
Hi Yes I ran "compute hash and file sig analysis"; the evidence pane shows MD5 values for all entries upon completion of this. This is why I can't understand why its not working.
Can you post your code? It does seem like odd behaviour.
Thank you for your reply!
I've now had an answer via the Guidance software forum.
The method has to be entry.HashValue().GetString() for it to work with the other two images. The previous method was apparently getting a hash object - just strange it worked with the L01 image.