Enterprise Vault™ EnCase® Ingest Connector Implementation Guide
About hashes
A hash is a sophisticated means of file authentication in which a 128-bit number is created based on the contents of the file, not including the file metadata. This number is often referred to as the file's digital fingerprint and uniquely identifies the file. The Ingest Connector employs the MD5 (Message Digest 5) algorithm for creating file hashes.
The Ingest Connector uses hashes for two purposes:
To prevent file duplication in the Collection Set. When a file in the Collection Set already exists, the Ingest Connector automatically compares the hashes of both copies to determine if the copy in the Collection Set is exactly the same as the one in the Evidence File.
To confirm that files copied into the vault arrived intact and uncorrupted. The Ingest Connector automatically performs separate hashes of the source copy and the destination copy. If either of these two hashes does not match after the copy is completed, an error is noted in the log file.
Note:
When any logical evidence file is created with Guidance Software's® EnCase® products, you must choose to include file hashes within EnCase for the Ingest Connector to be able to validate hashes. If hashes are not included during the acquisition of the logical evidence file, the Ingest Connector will log hash errors for each file.