Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

11

Hash Analysis and Timelines

We briefly discussed the use of hashes when we talked about performing evidence processing. Now we are going to get into more detail on how to use hashes to include or exclude files in your case. There are publicly available hash libraries you can use, and your organization may also maintain certain standard image files that you can generate hash libraries from. We will cover the most common use cases for how examiners can use hash libraries and hash sets to increase productivity in their casework.

Working ...