This section will describe the hash function contained within MacForensicsLab.
Using the Hash Function
The Hash functionality is a new feature added in MacForensicsLab 3.0. This button allows the examiner to quickly and easily create a hash of any device or file by highlighting it (1) and invoking the "Hash" button (2).
Reviewing the Hash
Once completed, the Hash window appears. The hash values are displayed in two separate fields. The first shows the hash data presented in a form for better human readability. The second field shows the raw hash data. Both contain the same information, just formatted differently for interoperability and readability.
Saving the Results
The results of the hash can be either saved out as a text file by clicking the Export button or added directly to the hash database. To export, simply select the formatting of the has you could like the export using the radio button, click "Export" and navigate to where the file is to be saved. To add the hash data to the database, select the database section from the drop down menu and click the “Add” button.
