Hashtab window update#
Hashtab window full#

From here, you can also choose to ignore all 'known' files that were found in the NSRL. From here, you can do a search to see all 'known bad' files. There is an option to choose the 'known status'. You can also see the results in the File Search window.

Other ingest modules are able to use the known status of a file to decide if they should ignore the file or process it. It will flag files that were in the notable hashset and those results will be shown in the Results tree of the Tree Viewer. There is an ingest module that will hash the files and look them up in the hashsets. idx file from the Hash Database Management window.

Hashtab window full#

You can also specify only the index file and not use the full hashset - the index file is sufficient to identify known files. If you attempt proceed without indexing a database, Autopsy will offer to automatically produce an index for you. You can manually create an index using the 'hfind' command line tool or you can use Autopsy. Autopsy uses the hash database management system from The Sleuth Kit. When you select the database from within this window, it will tell you if the index needs to be created. It can create the index if you import only the hashset.

HashKeeper: Hashset file conforming to the HashKeeper standard.Īutopsy needs an index of the hashset to actualy use a hash database.

MD5sum: Output from running the md5, md5sum, or md5deep program on a set of files.

This set will vary depending on the type of investigation, but common examples include contraband images and malware.Īutopsy allows for multiple known bad hash databases to be set.

Known bad (also called notable) files are those that should raise awareness.

Ignoring such uninteresting-to-the-investigator files, can greatly reduce image analysis time. This set of files frequently includes standard OS and application files.

Known good files are those that can be safely ignored.

Hash databases are used to identify files that are 'known'.

Hashtab window update#

The Hash Database Management window is where you can set and update your hash database information. The Hash Database Lookup Module calculates MD5 hash values for files and looks up hash values in a database to determine if the file is known bad, known (in general), or unknown.