Insights Blog

Using Custom Hash Sets in BlackLight

For examiners who aren’t yet accustomed to using BlackLight every day in their casework, the following question sometimes arises, since the answer is not altogether obvious: “I’ve created a custom hash set, so why don’t I see it as an available option for file filtering?”

custom_hash_sets_1b

The reason is that after you’ve created the custom hash set, you still must run the hash set for each evidence item on which you want to use the hash set filter.

To run a custom hash set, select ‘Evidence Status’ from the ‘Component List.’

custom_hash_sets_2

Click the yellow play icon in the ‘Known Files’ column for the desired device.

custom_hash_sets_3

A ‘Hash Sets’ window appears. Activate the checkbox for the custom hash set, select OK, and wait momentarily for processing to complete.

custom_hash_sets_4

The ‘Known Files’ column reads ‘Pending’ until the process is complete. When the process is complete, select the device in the ‘Component List’ and choose the ‘File Filter’ view.

Select [Hash Set] from the left drop-down menu if it’s not already selected. Voilà! Now you’ll see your custom hash set as an option in the right drop-down box. Select it and choose the the Filter button on the far right to run the filter.
custom_hash_sets_5b
Remember that you’ll need to repeat this process for each item in the ‘Component List’ for which you want to run the custom hash set filter.
If you have more questions about file filtering in BlackLight, our training team is always at the ready, so reach out.
Carpe Datum!

BlackBag Training Team

Our trusted training team has real world experience and are experts at delivering training you can use immediately. They have a passion for sharing techniques examiners can use every day to solve cases.Meet our training team and learn more about our courses at https://www.blackbagtech.com/training/
BlackBag Training Team