For the examiners who wish to locate malware in EnCase 6 based on virus signature, I have downloaded the latest VirusTotal database and compiled to an EnCase 6 Hash Set. Note that hashes are MD5 you need to hash your files first. Acknowledgments go to the VirusTotal for making available the files. Use this link for download. Hash Set contains more than 18 millions of hashes.