How to append hash values to an existing hash set

1. First, create a hash set containing the hashes you want to add to an existing hash set and save to an easy location such as your Desktop.
2. Click on the [Manage] menu in BlackLight and choose [Hash Sets...]
3. Highlight the hash set you want to add more hashes to and click on the Update button.
   
   
   
   
4. Navigate to the hash set you created in step 1 and click on the Open button
   
   
   
   
5. A pop-up message appears asking to replace or update the existing hash set. Click on the Update button.
   
   
   
   
6. A new pop up message displays how many hashes were added to the existing hash set. Click on the OK button and close the 'Manage Hash Sets' window.  
   
   
   
   
7. Go to the 'Evidence Status' view and click on the Run button under the 'Known Files' column. The 'Hash Sets' window will open. 
   Highlight the hash set you just updated in step 3, then right click and choose Reset. 
   
   
   
   
8. The window will refresh and a box will appear in place of the 'Complete' status. Check the box and click OK button. 
   
   
   
   
9. Repeat steps 7 and 8 for as many evidence items as needed.
   
   

The existing hash set is now updated with the additional hash values and applied to each evidence item. You can go to File Filter view and create a filter with the updated hash set.            

NOTE: The default location for BlackLight hash sets is:

Windows 7-10: \Users\<username>\AppData\Roaming\BlackBagTech\BlackLight\Hash Sets

macOS:  /Users/<username>/Library/Application Support/BlackBagTech/BlackLight/Hash Sets

The AppData directory on Windows and the Library directory on macOS are both hidden. This is why step 1 suggests creating the hash set to an easy location such as your Desktop. You can delete the created hash set from step 1 after the update completes.