EnCase hash map

The EnCase hash map is used by the Encase forensic software (early versions are known as Expert Witness) to store hash tables of data stored for the purpose of investigation, such as files and disk images taken from suspect hard drives.

File identification
The file begins with the hex header, which spells   in ASCII. (That's presumably for version 4; other versions may differ.)

Format
The MD5 hash format is used. A hash of the entire file is stored, followed by three zero bytes and then piecewise file-part hashes. The entire-file hash is preceded by the header given above, then the original filename in Unicode.

Links

 * Forensics wiki page on hash map
 * Forensics wiki page on EnCase
 * EnCase Ingest Connector Implementation Guide
 * EnCase forensics description
 * EWF Address Space