Jesse Kornblum

Using Triage Mode Output as Known Files

1

The programs should be able to accept Triage mode output files as files of known hashes. Ideally, output generated by the programs in -Z mode should be acceptable as input....

Using DFXML files as known hashes

1

The programs should be able to accept DFXML files as files of known hashes. Ideally, output generated by the programs in -d mode should be acceptable as input. Example: $...

Replace hash implementations with Library

2

I would like to replace the mishmash of hash algorithm implementations with a single library. This will allow us to quickly add support for new algorithms (e.g. SHA-3), remove worries...

As described at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841447: Dear Maintainer, "md5deep -rel /*" crashes my system (reboot) with a for me unkown reason. "sha256deep -rel /*" crashes in the same way. This was tested...

Running hashdeep crashes on OS X: ``` $ hashdeep -c all * Segmentation fault: 11 $ hashdeep -V 4.4 $ uname -ap Darwin jessek-mba.local 14.3.0 Darwin Kernel Version 14.3.0: Mon...

md5deep claims to have -B mode, but doesn't

1

The help message for md5deep claims to have a -B mode, but attempting to use it produces an error: $ md5deep -hh [...] -B - verbose mode; repeat for more...

DFXML can't be written to file

3

The Hashdeep DFXML output mode, -d, always writes the output data to stdout. This means the program ignores the -W mode to write the output to a file. The problem...

Add an option for Hashdeep to process only the first X bytes of each input file.

Handle Windows Data Deduplication Reparse Points

1

Windows Server 2012 can use "state-of-the-art deduplication that uses variable-chunking and compression". See http://blogs.technet.com/b/filecab/archive/2012/05/21/introduction-to-data-deduplication-in-windows-server-2012.aspx for background. The service works in the background to compress and deduplicate files. Modified files are...

Use Hashdeep to compare two signature files. "hashdeep -r known_dir > known_hashes and then make hashes of new files: hashdeep -r new_dir > new_hashes Then I would like to see...