start a fresh, blank hash database (and discard the existing current database, using the "Initialize" command, where you have the opportunity to select a new hash type), Via the Tools menu you get invoke the dialog window to manage the active hash database(s), which allows you to It also checks whether the matching hash sets all belong to the same category, and if not, will show a warning.Īn optional second, separate hash database of block hash values (instead of normal file hash values), stored in a separate directory, allows you to search for incomplete remnants of known highly relevant files block-wise on other media. If the hash value of a file is contained in multiple selected hash sets, the program will report all matching hash sets and indicate the category of one of the hash sets. The directory browser's optional columns Hash Set and "Category will then reveal for each file to which hash sets and category it belongs, if any (which allows you to sort/filter by these aspects and ignore irrelevant files easily or focus on files you are looking for). Hash values of files can be computed and matched against the hash database when refining the volume snapshot. Each hash set belongs to either the category irrelevant/known good/harmless or "notable"/known bad/malicious/relevant or can remain uncategorized (meaning "not decided yet" or "uncertain"). Useful if for example the primary hash database for general use is shared with colleagues on a network drive and the user wishes to create or import new hash sets, either for temporary use only or while the primary hash database is locked by other users, into a locally stored second database.Įach hash value in the hash database belongs to one or more hash sets. The second hash database may be stored on a different drive. some with MD5 and some with SHA-1 values) and wish to use them simultaneously. Useful for example if you receive hash sets from different sources with different hash types (e.g. It is possible to maintain two separate hash databases at the same time, databases based on the same hash type or different hash types. However, it cannot be updated while other users/instances are using it. The same hash database can be shared and used simultaneously by multiple users or instances if the same storage folder is selected. ), and it is up to the user to fill the hash database with hash sets and hash values, either by creating hash sets in X-Ways Forensics yourself or by importing hash sets from other sources.
It is up to the user to decide on what hash type the database will be based (MD5, SHA-1, SHA-256. Such an internal hash database is organized in a very efficient way, which maximizes performance when matching hash values. The storage folder is selected in the General Options dialog. An internal hash database, once created, consists of 257 binary files with the extension. Functionality only available with a forensic license.