Feb 262011
Fuzzy Hashing allow the discover of files that may not be locate using the traditional hashing methods. Here you can download a good document from Access Data.
This is an example of how it work on FTK3
On a case in FTK3 right click on a file (17.jpg) and select “Find Similar Files”:
after few mins you will get what you are looking for:
But, is the same files???
Different HASH means different files…. but not always.
Look better (and find the difference):
The “carved image” has lost a part so the HASH is different but the image is the same.
You can use this method when you have a piece of a pictures. It work VERY well with TEXT files. Try.