Verify / Create Hash

[Forensik]

Working with an EnCase image I would like to verify the inage time by time. Whereas OSF allows verification of Files, Volumes and Text there seems to be no feature to verify an image. How can I do this?

Does OSF check the CRC Hashes of Encase images when an image is added to the case?

Best regards

[David (PassMark)]

> I would like to verify the inage time by time

Not exactly sure what you mean by this.

But an image file is still just a file.
So you can use the "Verify / Create Hash" function OSF to generate a hash of the whole image file.

I am not sure how Encase calculates their CRC hashes. So I don't know if the MD5, SHA1, CRC32, SHA-256 values produced by OSF will match the Encase value or not.

I am fairly sure we aren't automatically checking Encase hash values, but can check the details.

[keith]

Does OSF check the CRC Hashes of Encase images when an image is added to the case?

If you are referring to the internal CRC values that are appended to each block of the Encase image, then yes they are checked.

[Forensik]

Thanks keith,
I was hopping OSF is checking these internal CRC values ensuring the integrity of the image. And it does. Great.

Best regards from Up Over to Down Under.