Clone this wiki locally
Welcome to the hashdb wiki!
hashdb is a tool for finding previously identified blocks of data in media such as disk images. hashdb provides the following:
- The hashdb tool used to create hash databases, import block hashes, scan, and manage block hash databases.
- The hashdb library providing C++ and Python interfaces.
- Rapid Recognition of Blacklisted Files and Fragments describes how hashdb and SectorScope are effective in a digital Forensics toolchain.
- Inferring Past Activity from Partial Digital Artifacts describes how digital residue is used to infer how a computer was used.
- Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb defines hash-based carving and provides additional references.
- Distinct Sector Hashes for Target File Detection describes using hash identifiers to identify the source of digital content in forensic investigations.
- Using purpose-built functions and block hashes to enable small block and sub-file forensics explores using small hashes for identifying data in file fragments.
- Using Distinct Sectors in Media Sampling and Full Media Analysis to Detect Presence of Documents From a Corpus is the thesis created by Kristina Foster from which hashdb was based.
- Developer: Bruce Allen bdallen nps edu.
- Bulk Extractor Users Group: http://groups.google.com/group/bulk_extractor-users.