Feb 262011
 

Fuzzy Hashing allow the discover of files that may not be locate using the traditional hashing methods. Here you can download a good document from Access Data.

This is an example of how it work on FTK3

On a case in FTK3 right click on a file (17.jpg) and select “Find Similar Files”:

after few mins you will get what you are looking for:

But, is the same files???

Different HASH means different files…. but not always.

Look better (and find the difference):

The “carved image” has lost a part so the HASH is different but the image is the same.

You can use this method when you have a piece of a pictures. It work VERY well with TEXT files. Try.

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>