IPED icon indicating copy to clipboard operation
IPED copied to clipboard

Extraction of partial hashes info for LedCarveTask carved files and other files

Open patrickdalla opened this issue 6 months ago • 0 comments

I've noted that the partial hash info of filed carved by LedCarveTask is only stored in fields hashDB:md5_512 and hashDB:md5_64k if its integral hash matches with some hash in configured know files database. In particular conversation with Wladmir, he informed that this occurs because this info is not extracted by LedCarveTask, but by HashDBLookupTask, that only handles integral hash info. So I suggested him to save this info, and I am registering this in this issue (enhancement). This info can be useful to indirecly match files that reference other files by their hash, searching the database for correspondent md5_512 and md5_64k info, and storing the result in LINKED_ITEMS queries. So if, for example, an Shareaza Download file is found or carved, it referenced file can be linked searching for the partial hashes in the DB and creating the query terms in LINKED_ITEMS. If it were carved by LedCarveTask, then it will be shown in referenced files. Wladmir suggested that this can be used to link to incomplete files, as well. In this case, the file is not carved as it may be active, so the partial MD5 calc should be done by specific task.

patrickdalla avatar Aug 01 '24 21:08 patrickdalla