±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 34321
New Yesterday: 7 Visitors: 137

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Rebuild Hash Library Error?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Rebuild Hash Library Error?

Post Posted: Tue Nov 23, 2010 9:52 am

Im trying to rebuild a hash library (v.6) and when I right click the selected hash sets then click 'rebuild library' I get this error:

Error: Cannot delete output file 'C:\Program Files\EnCase6.13\encase.Hash'

Any ideas?
Thanks in advance  

oreo
Newbie
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Tue Nov 23, 2010 10:06 am

Are you running EnCase on Windows Vista or 7? If so, are you running EnCase as an Administrator, or with UAC disabled?

HTH

Ben
_________________
Ben Findlay. BSc (Hons) MSc MBCS MCSFS MIScT
Course Leader BSc Computer and Digital Forensics
Senior Lecturer MSc Crime Intelligence & Data Analytics
School of Science, Engineering and Design
Teesside University 

benfindlay
Senior Member
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Wed Nov 24, 2010 5:26 am

I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.

Tom
_________________
CHFI, CCNA, EnCE
Digital Forensic Analyst 

CdtDelta
Senior Member
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Wed Nov 24, 2010 10:09 am

- CdtDelta
I've also seen this error if you have more than one instance (of the same version in your case) of EnCase running, and you've rebuilt the hash sets on the other one already.

Tom


- Guidance Software

"The software is functioning as designed."


don't get me started.  

hmorgan
Senior Member
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Wed Nov 24, 2010 2:37 pm

The "encase.hash" file seems to be relatively recent (by which I mean, within the last two years). I believe what it's doing is joining the hashes from the currently selected sets (removing duplicates) and putting them on disk as opposed to keeping them in memory. All well and good for if you have lots of hash sets loaded.

The problem is that it's extraordinarily common for examiners to run multiple instances of EnCase simultaneously. Having a single, modifiable file shared amongst multiple instances, all doing different things, is... bad.

The irony is that each EnCase instance will create its own unique "console" file, for backing the console view in EnCase. You can see these in the EnCase\Temp folder: console-1.txt, console-2.txt, etc. The previous limit on the number of instances you could run at a time was 6, because EnCase will roll back over to console-1.txt at that point. Then you get a sharing violation error when you open up EnCase.

This leads to two interesting questions:

1. If per-instance files can be used for the console, why not for the hash library?

2. Why is the limit on consoles "6"?


Jon
_________________
Jon Stewart, Principal
(646) 719-0317 | jon @ lightboxtechnologies.com | Arlington, VA
Fash search for EnCase: www.lightgrep.com 

jonstewart
Member
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Wed Nov 24, 2010 11:52 pm

This is a known issue with EnCase v6 and an "Enhancement request" has been submitted on their support forums. You can not use hash sets with multiple instances of EnCase open. I highly doubt this will change in V6 since V7 is due out next year sometime.

Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.

Best regards,
Tony  

balzanto
Senior Member
 
 
  

Re: Rebuild Hash Library Error?

Post Posted: Fri Nov 26, 2010 3:41 pm

- balzanto

Jon - Given the way EnCase has to reload and rebuild so much depending on the tasks run when opening a case, many EnCase users have adopted having multiple case files for various aspects of the examination. I don't think it is extraordinary to have multiple instances open. I will usually have 3-5 case files for one exam and have two or more open at any given time, especially when preparing my report.


Hi Tony,

I completely agree with you; I think you misread my post. I said it's "extraordinarily common" for folks to have multiple instances running, for the reasons you note. It's a frustrating problem, and it's hard to imagine that the fix would be difficult to implement.


Jon
_________________
Jon Stewart, Principal
(646) 719-0317 | jon @ lightboxtechnologies.com | Arlington, VA
Fash search for EnCase: www.lightgrep.com 

jonstewart
Member
 
 

Page 1 of 2
Go to page 1, 2  Next