You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've noted that the partial hash info of filed carved by LedCarveTask is only stored in fields hashDB:md5_512 and hashDB:md5_64k if its integral hash matches with some hash in configured know files database.
In particular conversation with Wladmir, he informed that this occurs because this info is not extracted by LedCarveTask, but by HashDBLookupTask, that only handles integral hash info.
So I suggested him to save this info, and I am registering this in this issue (enhancement).
This info can be useful to indirecly match files that reference other files by their hash, searching the database for correspondent md5_512 and md5_64k info, and storing the result in LINKED_ITEMS queries.
So if, for example, an Shareaza Download file is found or carved, it referenced file can be linked searching for the partial hashes in the DB and creating the query terms in LINKED_ITEMS. If it were carved by LedCarveTask, then it will be shown in referenced files.
Wladmir suggested that this can be used to link to incomplete files, as well. In this case, the file is not carved as it may be active, so the partial MD5 calc should be done by specific task.
The text was updated successfully, but these errors were encountered:
I've noted that the partial hash info of filed carved by LedCarveTask is only stored in fields hashDB:md5_512 and hashDB:md5_64k if its integral hash matches with some hash in configured know files database.
In particular conversation with Wladmir, he informed that this occurs because this info is not extracted by LedCarveTask, but by HashDBLookupTask, that only handles integral hash info.
So I suggested him to save this info, and I am registering this in this issue (enhancement).
This info can be useful to indirecly match files that reference other files by their hash, searching the database for correspondent md5_512 and md5_64k info, and storing the result in LINKED_ITEMS queries.
So if, for example, an Shareaza Download file is found or carved, it referenced file can be linked searching for the partial hashes in the DB and creating the query terms in LINKED_ITEMS. If it were carved by LedCarveTask, then it will be shown in referenced files.
Wladmir suggested that this can be used to link to incomplete files, as well. In this case, the file is not carved as it may be active, so the partial MD5 calc should be done by specific task.
The text was updated successfully, but these errors were encountered: