2011-01-22

Empty hash values don't get sorted?

Weird thing in EnCase 6.18 I came across today: when sorting by the Hash Value field, entries without hash values (0-byte contents) seem immune to sorting, and seem to remain in a stable ordering, relative to each other. You can see this in this screenshot, where the evidence is in a logical evidence file with folders that don't have content. I don't know whether this is specific to logical evidence files, but it's somewhat annoying.