Fuzzy Hashing - Jesse Kornblum

More documents

Recommendations

Info

Future Research Finding footers and middles Current carvers require true footer Encase, iLook, Foremost, Scalpel, etc. Find blocks that are "JPEGy" or "GIFy" Lots of academic research No practical tools What makes things similar? Lots of research to date Most focuses on plagiarism by CS studentsManTech CFIA36
Conclusion <strong>Fuzzy</strong> <strong>Hashing</strong> allows examiners to find documents that are similarbut not quite identical. ssdeep is Free and Open Source http://ssdeep.sf.net/ Windows executable and source code Graphical Front End now available! Questions? Write to me at jesse.kornblum@mantech.com. I am always available for LEManTech CFIA37
Page 1: ManTech SMAComputer Forensics and I
Page 4 and 5: The Joy of Hashing Hashing reduces
Page 7 and 8: Disclaimer I didn’t invent this m
Page 9 and 10: MD5 Explained If you change one bit
Page 11 and 12: Rolling Hash It would be nice to se
Page 13: Rolling HashTo update state (c,x,y,
Page 20 and 21: Rolling HashDeep into the darkness
Page 23 and 24: Demonstration Word DocumentsManTech
Page 25: DemonstrationWARNING:EXPLICIT IMAGE
Page 29 and 30: Demonstration File headerKnown kitt
Page 31 and 32: Demonstration Source code reuseManT
Page 33 and 34: IssuesMatching via Fuzzy Hashing is
Page 35: Future Research File footer Reconst

Fuzzy Hashing - Jesse Kornblum

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?