Difference between revisions of "Hashing"

From ForensicsWiki
Jump to: navigation, search
m (Reverted edits by Gm7Bwm (Talk); changed back to last version by Jessek)
m
Line 2: Line 2:
  
 
== Tools ==
 
== Tools ==
 
 
There are literally hundreds of hashing programs out there, but a few related to forensics are:
 
There are literally hundreds of hashing programs out there, but a few related to forensics are:
  
Line 8: Line 7:
 
* [[md5deep]] - Computes hashes, recursively if desired, and can compare the results to known values.
 
* [[md5deep]] - Computes hashes, recursively if desired, and can compare the results to known values.
 
* [[ssdeep]] - Computes and matches [[Context Triggered Piecewise Hashes]].
 
* [[ssdeep]] - Computes and matches [[Context Triggered Piecewise Hashes]].
 +
 +
==Hash Databases==
 +
NSRL
 +
 +
==Hash Lookup Services==
 +
There are several online services that you

Revision as of 01:28, 16 December 2007

Hashing is a method for reducing large inputs to a smaller fixed size output. When doing forensics, typically cryptographic hashing algorithms like MD5 and SHA-1 are used. These functions have a few properties useful to forensics. Other types of hashing, such as Context Triggered Piecewise Hashing can also be used.

Tools

There are literally hundreds of hashing programs out there, but a few related to forensics are:

Hash Databases

NSRL

Hash Lookup Services

There are several online services that you