PAPERS
THE SIXTH INTERNATIONAL CONFERENCE ON FORENSIC COMPUTER SCIENCE
Print ISBN 978-85-65069-07-6 - Online ISBN 978-85-65069-05-2, pp 137-141
DOI: 10.5769/C2011015 and http://dx.doi.org/10.5769/C2011015
Creation and Maintenance of MD5 Hash Libraries, and Their Application in Cases of Child Pornography
By Alexandre Vrubel
To download this paper, click here.
Print ISBN 978-85-65069-07-6 - Online ISBN 978-85-65069-05-2, pp 137-141
DOI: 10.5769/C2011015 and http://dx.doi.org/10.5769/C2011015
Creation and Maintenance of MD5 Hash Libraries, and Their Application in Cases of Child Pornography
By Alexandre Vrubel
To download this paper, click here.
ABSTRACT
Forensic programs, such as Guidance EnCase, allow the use of hashes of known files, to ease the selection of files to be analyzed or ignored in Computer Forensics examinations. However, these same programs do not allow an effective maintenance of their hash libraries. To remedy this deficiency, the HashManager tool was developed, which is able to create, manage and use libraries of millions of MD5 hashes in seconds. HashManager allows the calculation of the union, intersection and difference of hash libraries. These libraries are stored and processed as simple text files, but HashManager is able to convert them to the EnCase format, if needed. Hash libraries of files related to child pornography have been built, with the aim of increasing productivity in these types of examination. These hash libraries, HashManager and other auxiliary tools are freely available to the community of Computer Forensics.
KEYWORDS
Hash libraries, child pornography, pedophilia, MD5, HashManager
Forensic programs, such as Guidance EnCase, allow the use of hashes of known files, to ease the selection of files to be analyzed or ignored in Computer Forensics examinations. However, these same programs do not allow an effective maintenance of their hash libraries. To remedy this deficiency, the HashManager tool was developed, which is able to create, manage and use libraries of millions of MD5 hashes in seconds. HashManager allows the calculation of the union, intersection and difference of hash libraries. These libraries are stored and processed as simple text files, but HashManager is able to convert them to the EnCase format, if needed. Hash libraries of files related to child pornography have been built, with the aim of increasing productivity in these types of examination. These hash libraries, HashManager and other auxiliary tools are freely available to the community of Computer Forensics.
KEYWORDS
Hash libraries, child pornography, pedophilia, MD5, HashManager
To return to the "Published Papers" main page, click here.