Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extraction of partial hashes info for LedCarveTask carved files and other files #2271

Open
patrickdalla opened this issue Aug 1, 2024 · 0 comments

Comments

@patrickdalla
Copy link
Collaborator

patrickdalla commented Aug 1, 2024

I've noted that the partial hash info of filed carved by LedCarveTask is only stored in fields hashDB:md5_512 and hashDB:md5_64k if its integral hash matches with some hash in configured know files database.
In particular conversation with Wladmir, he informed that this occurs because this info is not extracted by LedCarveTask, but by HashDBLookupTask, that only handles integral hash info.
So I suggested him to save this info, and I am registering this in this issue (enhancement).
This info can be useful to indirecly match files that reference other files by their hash, searching the database for correspondent md5_512 and md5_64k info, and storing the result in LINKED_ITEMS queries.
So if, for example, an Shareaza Download file is found or carved, it referenced file can be linked searching for the partial hashes in the DB and creating the query terms in LINKED_ITEMS. If it were carved by LedCarveTask, then it will be shown in referenced files.
Wladmir suggested that this can be used to link to incomplete files, as well. In this case, the file is not carved as it may be active, so the partial MD5 calc should be done by specific task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants