Rebuild Hash Librar...
 
Notifications
Clear all

Rebuild Hash Library Error?  

  RSS
oreo
 oreo
(@oreo)
New Member

Im trying to rebuild a hash library (v.6) and when I right click the selected hash sets then click 'rebuild library' I get this error

Error Cannot delete output file 'C\Program Files\EnCase6.13\encase.Hash'

Any ideas?
Thanks in advance

Quote
Posted : 23/11/2010 2:52 pm
benfindlay
(@benfindlay)
Active Member

Are you running EnCase on Windows Vista or 7? If so, are you running EnCase as an Administrator, or with UAC disabled?

HTH

Ben

ReplyQuote
Posted : 23/11/2010 3:06 pm
CdtDelta
(@cdtdelta)
Active Member

I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.

Tom

ReplyQuote
Posted : 24/11/2010 10:26 am
hmorgan
(@hmorgan)
Active Member

I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.

Tom

"The software is functioning as designed."

don't get me started.

ReplyQuote
Posted : 24/11/2010 3:09 pm
jonstewart
(@jonstewart)
Junior Member

The "encase.hash" file seems to be relatively recent (by which I mean, within the last two years). I believe what it's doing is joining the hashes from the currently selected sets (removing duplicates) and putting them on disk as opposed to keeping them in memory. All well and good for if you have lots of hash sets loaded.

The problem is that it's extraordinarily common for examiners to run multiple instances of EnCase simultaneously. Having a single, modifiable file shared amongst multiple instances, all doing different things, is… bad.

The irony is that each EnCase instance will create its own unique "console" file, for backing the console view in EnCase. You can see these in the EnCase\Temp folder console-1.txt, console-2.txt, etc. The previous limit on the number of instances you could run at a time was 6, because EnCase will roll back over to console-1.txt at that point. Then you get a sharing violation error when you open up EnCase.

This leads to two interesting questions

1. If per-instance files can be used for the console, why not for the hash library?

2. Why is the limit on consoles "6"?

Jon

ReplyQuote
Posted : 24/11/2010 7:37 pm
balzanto
(@balzanto)
Member

This is a known issue with EnCase v6 and an "Enhancement request" has been submitted on their support forums. You can not use hash sets with multiple instances of EnCase open. I highly doubt this will change in V6 since V7 is due out next year sometime.

Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.

Best regards,
Tony

ReplyQuote
Posted : 25/11/2010 4:52 am
jonstewart
(@jonstewart)
Junior Member

Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.

Hi Tony,

I completely agree with you; I think you misread my post. I said it's "extraordinarily common" for folks to have multiple instances running, for the reasons you note. It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.

Jon

ReplyQuote
Posted : 26/11/2010 8:41 pm
balzanto
(@balzanto)
Member

Hi Tony,

I completely agree with you; I think you misread my post. I said it's "extraordinarily common" for folks to have multiple instances running, for the reasons you note. It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.

Jon

Sorry Jon, you are correct and yes, it is one of many frustrating problems associated with EnCase.

Hope all is well,
Tony

ReplyQuote
Posted : 27/11/2010 12:28 am
hmorgan
(@hmorgan)
Active Member

It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.

Jon

Exactly, I'd guess it's as simple as keeping better control of file handles.

ReplyQuote
Posted : 29/11/2010 7:35 pm
hmorgan
(@hmorgan)
Active Member

FWIW
Using 'Unlocker' to close the file handle for the encase.hash file (in the prog files\encase folder) seems to do the trick with no apparent nasty side affects.

(no guarantees - test first on non production environment of course)

ReplyQuote
Posted : 01/12/2010 8:51 pm
Share: