Bug#309497: ITP: md5deep -- a cross-platform set of programs to compute MD5, SHA-1, SHA-256, or Whirlpool message digests on an arbitrary number of files

[Niall Sheridan <niall@blacknight.ie>]

Hi there

On Tue, 2005-05-17 at 19:53 +0200, Eduard Bloch wrote:
> $ man cfv |grep sha1
> ...
>               csv4, sha1, md5, bsdmd5, par, par2, torrent, crc, or auto.   The
> 
Fair point.
> > 	* Recursive operation - md5deep is able to recursive examine an entire 
> > 	* Time estimation - md5deep can produce a time estimate when it's
> > 	* Comparison mode - md5deep can accept a list of known hashes and 
> > 	  compare them to a set of input files. The program can display either
> > 	  those input files that match the list of known hashes or those that 
> > 	  do not match. Hashes sets can be drawn from the National Software
> > 	  Reference Library, iLook Investigator, Hashkeeper, or md5sum.
> 
> What do you mean with "drawn"? What is this library and others? Besides
> of this "feature", cfv does all that (at least similarly), and much more.
md5deep is intended to be used in computer forensics (though it
obviously has other uses.)
The library and others supply hash sets of known application files which
can be used with md5deep to discard known files or to check for modified
files based on the hash values.
>From the NSRL (www.nsrl.nist.gov) website:
The National Software Reference Library (NSRL) provides a repository of
known software, file profiles, and file signatures for use by law
enforcement and other organizations in computer forensics
investigations.

iLook Investigator and Hashkeeper provide similar hash databases.
> > 	* File type mode - md5deep can process only files of a certain type,
> > 	  such as regular files, block devices, etc. 
> 
> Sounds like a nice feature to add.
> 
> Regards,
> Eduard.

Cheers,
Niall