Hi,
I can see how the hash of a logical file in EnCase image?
The "Report" of EnCase v7.09 shows the hash of each file composing logic image but not the hash of the image file which is just what I need.
Can you help?
Regards.
Are you looking for the hash value of the L01 or Lx01? or are you looking for the hash value of a file within the evidence file?
First, using FTK Imager Lite, "add" the evidence file you want to recover the acquisition hash from.
Once the evidence file has been added to FTK Imager Lite, right click on the top level evidence file name in the "Evidence Tree" window.
Then left click on "Verify Drive/Image…." and FTK Imager will give you the MD5 & SHA1 hash values
Computed hash
Stored verification hash
Report hash
Verify result (MATCH) hopefully
Encase 7 does not hash the entire L01x file; it only hashes the individual files in the logical evidence file. Since it doesn't hash the entire logical evidence file, there won't be an acquisition hash in the header data of the file as there would be with an E01x file.