EnCase EnScript to hash selected files and provide SHA1_Base16 & SHA1_Base32 values

A fellow examiner asked for an EnScript that provides the base32 SHA1 hash value for selected files. This EnScript generates the common base16 SHA1 hash value for selected files. In addition, it converts the base16 SHA1 hash value to a base32 SHA1 value for use in limewire investigations.

To use, just select the files you want the SHA1 values for and then run the EnScript. The output is in the console tab.



Download here

Updated EnScript to hash selected text and provide MD5, SHA1-Base16 and SHA1-Base32 values

I recently posted an EnScript to provide the hash value of selected text within EnCase.

This is an update to that EnScript and it provides the MD5 hash, SHA1_base16 (hex) hash and SHA1_base32 hash values for those that do limewire type investigations.



Download here

EnScript to hash selected text

I was doing some testing and needed to hash just a portion of some files, not their entire contents. So I decided to write a quick EnScript to hash just the selected characters from within a file.

To use this EnScript, simply select whatever characters you want to include in your hash results and run the EnScript.



The EnScript will automatically determine which file you have text selected in and the number of bytes. The EnScript will calculate a MD5 and a SHA1 hash of the selected text:



Download here

EnScript to Compare evidence against hash set(s) and export files not in the hash set(s)

On an idea from Timothy LaTulippe, this EnScript was written to basically "de-NIST" your evidence.

This EnScript will compare all the files in the case against whatever hash sets you select (aka all the NIST ones or your own custom Windows hash sets) and then it will export all the files that do not match any of the hash sets, maintaining the original paths.

First, select whatever hash sets you want to use and rebuild your library with the ones you want to include in the comparison:



Then run the EnScript and choose an export path:



If you check the LEF box, a logical evidence file will also be made with all the files that do not match any of your included hash sets.

Download Here

Import a text file of Hash values into a EnCase hash set.

In July, I posted an EnScript that I wrote to import a text file containing the name, size and hash value of file(s) into a EnCase hash set (You can read it here).

I have modified the EnScript to import a simple text file containing just hash values. This was based on a request by a reader and it was a simple chage to make. This new version now imports a simple ASCII text file containing one hash value per line:

937D87886E076C3A9DFC41AF47430E40
AB9A6395505AB2912FA4C6D7927CF359
8D7CDC05145498CC65585171C0084378
F248F38E1A22C94D52E8277AFC89FD90
AF64E5AE9080B01B61344B7C7AF9C972
633395C2507E03AFB2F7DCF34B2B8831
D41D8CD98F00B204E9800998ECF8427E
AB9A6395505AB2912FA4C6D7927CF359
254D506F104A52486B005F9B2C2D3C37
7D1844587162237957143B353679EFF6

The EnScript will create a .hash file in your default export folder that can then be copied into your EnCase\Hash Sets\ folder and used inside EnCase.

Download Here (v5 & v6)

Adding Hash values to an existing .hash file in EnCase

In my previous post I explained that in the past I have had the need to import hash values from a text file into an EnCase .hash file for use by EnCase and therefore I created an EnScript to import from a text file. In addition, I have also had the need to add hashes to an existing .hash file in EnCase.

You can easily make a hash set in EnCase, but you cannot add to an existing hash set within EnCase. To make matters worse, what if you don't have the files that were used to create a hash set, for example, if the hash set was given to you by another examiner? You would have to create a new hash set with the new files and then also keep the existing one.

Therefore, I wrote an EnScript to hash and then add selected (blue checked) files into an existing EnCase .hash set. The main purpose for writing this was so I could continually add hash values of hacker tools or malware into one hash set, without having to have or maintain the original files to rehash them in order to make a new hash set.

Enjoy.. (tested in v6.5)

Download Here

Importing hash values from a text file into EnCase

While doing an compartmentalized team investigation, I had a need to look for several dozen files that I did not actually have possession of as they were collected by another group. I was given a text file with the hash values of the files I was instructed to look for. I needed a quick way to import the hash values into a hash set for EnCase.

This EnScript reads a simple comma delimited text file with 3 fields per line; filename,size,hash. The name and size are ignored (the file was made by a third party utility) and the hash value is read in and a .hash file is created for use by EnCase.


Download Here