Fuzzy Hashing - Jesse Kornblum

More documents

Recommendations

Info

The Joy of <strong>Hashing</strong> <strong>Hashing</strong> reduces any input to a fixed size output Lots of different hashing algorithms Most are not suited for forensics We use cryptographic hashing algorithms MD5, SHA-1, Whirlpool, Tiger These are great for finding identical things Can’t be used to find similar thingsManTech CFIA4
What is “Similar”This is a hard question“How are you” vs. “How are y0u”Blade Runner vs. The Fifth ElementPlotThemesMotifs (e.g. Messages at lunch counter)Streams of ones and zerosManTech CFIA5
Page 1: ManTech SMAComputer Forensics and I
Page 7 and 8: Disclaimer I didn’t invent this m
Page 9 and 10: MD5 Explained If you change one bit
Page 11 and 12: Rolling Hash It would be nice to se
Page 13: Rolling HashTo update state (c,x,y,
Page 20 and 21: Rolling HashDeep into the darkness
Page 23 and 24: Demonstration Word DocumentsManTech
Page 25: DemonstrationWARNING:EXPLICIT IMAGE
Page 29 and 30: Demonstration File headerKnown kitt
Page 31 and 32: Demonstration Source code reuseManT
Page 33 and 34: IssuesMatching via Fuzzy Hashing is
Page 35 and 36: Future Research File footer Reconst
Page 37 and 38: Conclusion Fuzzy Hashing allows exa

Fuzzy Hashing - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?