Re: [sleuthkit-users] MD5 Hashes in Autopsy 4.0.0

[Justin G. <jus...@gm...>]

Brian and Mark-- Thanks for the responses. Disregard my original post...  I
just opened the case back up in Autopsy and now the hash was present. Go
figure... Maybe I just needed to close/re-open it for it to display
properly. Or maybe the module wasn't finished processing when I looked.
Who knows!  It's there now :)

-Justin

On Mon, Dec 14, 2015 at 10:40 PM, Brian Carrier <ca...@sl...>
wrote:

> Does the file’s row in the table have the hash (far right column)?
>
> If you go to the Hex view, can you page through the entire file?
> Sometimes the file can’t be read and therefore the hash is not calculated.
> That is much more common with deleted files though.
>
>
>
> > On Dec 14, 2015, at 3:43 PM, Justin Grover <jus...@gm...>
> wrote:
> >
> > Currently using Autopsy 4.0.0 on Windows 7.
> >
> > I'm trying to get Autopsy to display the hash of a file.  When checking
> each file's "File Metadata" tab, it seems like the MD5 hash of some files
> display, but not others.  I've already run the Hash Lookup ingest module on
> my data source (no hash database used).
> >
> > Is there some way to get Autopsy to calculate and display the hash of
> all files?
> >
> > Attached is a screenshot from one of my File Metadata tabs.
> >
> > -Justin
> >
> <file_hashes.png>------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>