Re: [sleuthkit-users] MD5 Hashes in Autopsy 4.0.0

[Brian C. <ca...@sl...>]

Does the file’s row in the table have the hash (far right column)?

If you go to the Hex view, can you page through the entire file?  Sometimes the file can’t be read and therefore the hash is not calculated. That is much more common with deleted files though. 



> On Dec 14, 2015, at 3:43 PM, Justin Grover <jus...@gm...> wrote:
> 
> Currently using Autopsy 4.0.0 on Windows 7.
> 
> I'm trying to get Autopsy to display the hash of a file.  When checking each file's "File Metadata" tab, it seems like the MD5 hash of some files display, but not others.  I've already run the Hash Lookup ingest module on my data source (no hash database used).
> 
> Is there some way to get Autopsy to calculate and display the hash of all files?
> 
> Attached is a screenshot from one of my File Metadata tabs.
> 
> -Justin
> <file_hashes.png>------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org