?
Solved

Encase Version 5 - Hash analysis

Posted on 2006-11-27
11
Medium Priority
?
1,043 Views
Last Modified: 2008-01-09
I have to solve a crime related to an extortion incident using Encase version 5 (for educational purpose). I do not know anything about hash analysis.
1. What the heck is it?
2. What does it accomplish?
3. How do i do it?
0
Comment
Question by:sergeiweerasuriya
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
11 Comments
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 18020831
I'm guessing the meaning here is to take a hash of all the files on the system using e.g. md5 and then comparing against a database of hash values for "interesting" files.

For an extortion case, the database might have hashes for a bunch of documents related to the extortion subject. Then you can use this technique to easily find copies of those documents.

Not sure exactly how you do this in Encase 5.
0
 

Author Comment

by:sergeiweerasuriya
ID: 18020935
finding out how to do it in Encase is not difficult, if i knew what files to look for. The documents related to the extortion case are a bunch of email messages. I do not see the point in checking an email message for hash vaues. Lets say i check the hash value of an email file. If i do so what would it tell me about that particular file?
0
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 18021245
Yeah, probably no so useful on an email file as much as on an individual email.
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 

Author Comment

by:sergeiweerasuriya
ID: 18021275
what do u mean "not so useful on an email file as much as on an individual email"? what's the difference between an email file an an individual email?
0
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 18021292
The hash method usually works at the file level. An email file usually has many emails in it.
0
 

Author Comment

by:sergeiweerasuriya
ID: 18027452
So when analysing email files what should i look for. Is it only the contents of the email? Some emails seem quite bizzare to me for instance the date created, sent and recieved appear to be the same (same hour,minute and second).
0
 
LVL 14

Accepted Solution

by:
chris_calabrese earned 1000 total points
ID: 18028401
For an extortion case you'd be looking primarily at content. You'd look at the timestamps and such if you thought that the emails were forged or planted.
0
 
LVL 4

Assisted Solution

by:SPOued
SPOued earned 1000 total points
ID: 18044295
sergeiweerasuriya,
I've used encase (in testing only), and the "hash" being referred to seems to me to be the value which you need to use when comparing the original data to the duplicated one to insure integrity. Encase usually works by creating an exact duplicate of the data (without leaving any trace) being investigated. If you're to take a case to court, the court would like to know that the data from which you've acquired evidence has not been altered, meaning you'll need a hash to check the integrity.
So, in a nutshell, hash analysis, is just about making sure you have an exact duplicate of the original data...
Hope this helps...
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.
Hey fellow admins! This time, I have a little fairy tale for you. As many tales do, it starts boring and then gets pretty gory. I hope you like it. TL;DR: It is about an important security matter, you should read it if you run or administer Windows …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question