Home

Welcome to the hashdb wiki!

hashdb is a tool for finding previously identified blocks of data in media such as disk images. hashdb provides the following:

• The hashdb tool used to create hash databases, import block hashes, scan, and manage block hash databases.
• The hashdb library providing C++ and Python interfaces.

hashdb is available for Windows, Linux, and Mac users, please see Installing hashdb.

hashdb Version 3.1.0

hashdb v3.1.0 fixes a halting bug encountered when creating large databases. It is similar to hashdb v3.0.0, but does not record source offset values. It is available for download here or, for developers, from GitHub.

hashdb v3.1.0 is not compatible with hashdb v3.0.0. Users are not encouraged to update to v3.1.0 unless they expect to require a very large database.

For further information on this release, please see the latest Release Notes under the doc/announce directory, here.

hashdb Version 3.0.0

hashdb Version 3.0.0 is available for download here.

Compatibility with SectorScope and bulk_extractor

hashdb Version 3.1.0 breaks compatibility with SectorScope and bulk_extractor. To use these tools:

• SectorScope: Please use SectorScope v0.7.1.
• bulk_extractor: Please re-build with the updated scanner available at hashdb 3.1.0 and bulk_extractor.

Quick Links

• Release Notes
• hashdb Users Manual
• hashdb Quick Reference
• Download
• Install
• License

Papers

• Rapid Recognition of Blacklisted Files and Fragments describes how hashdb and SectorScope are effective in a digital Forensics toolchain.
• Inferring Past Activity from Partial Digital Artifacts describes how digital residue is used to infer how a computer was used.
• Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb defines hash-based carving and provides additional references.
• Distinct Sector Hashes for Target File Detection describes using hash identifiers to identify the source of digital content in forensic investigations.
• Using purpose-built functions and block hashes to enable small block and sub-file forensics explores using small hashes for identifying data in file fragments.
• Using Distinct Sectors in Media Sampling and Full Media Analysis to Detect Presence of Documents From a Corpus is the thesis created by Kristina Foster from which hashdb was based.

Contacts

• Developer: Bruce Allen bdallen nps edu.
• Bulk Extractor Users Group: http://groups.google.com/group/bulk_extractor-users.