This plug-in calculates ADLER, CRC-32, MD-4, MD-5, SHA-1, SHA-256 and SHA-512 hash-values for the highlighted item. The script will also calculate a version of the MD-4 hash used by the eMule & eDonkey file-sharing software.

The script can hash the item's entire logical content or it can determine what to hash automatically based on the user's selection.

If the second option is chosen the script will hash the data highlighted by the user provided that something other than just the first byte at the start of the item's data has been selected. Otherwise it will hash the item's entire logical content.

The script can also hash the highlighted ANSI/ASCII text with the option of editing that text beforehand.

The script will present the calculated hash-values in a dialog box; it will also write them to the console window.

Taking the 'Send SHA-256 Hash to VirusTotal' option will cause the script to open a URL taking the user's default browser to VirusTotal so that he/she can view the analysis results for the hash in question. Note that this is a 'cheap' way of performing lookups that may, on occasion, cause the VirusTotal website to present a Captcha dialog or block access in an effort to prevent abuse of service.

The 'Send Process Hash to VirusTotal' option can be used to send a snapshot process-hash to VirusTotal. The script will use the SHA-1 hash if available. If not, the MD-5 hash. Note that for this option to work, the list of processes must be promoted to the table pane using the Browse Data button.

The 'Send Process Hash to VirusTotal' option does not work with the Analysis Browser, which is an EnScript shown in the EnCase GUI.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training