Welcome back, to the computer forensics path.
In this course, Course 12,
we're talking about hashing.
In this module, Module 2,
we're going to talk about creating hash sets.
Why are we create hash sets,
and what we can use them for.
The NIST hash set.
NIST is a database or a list of hash values.
These hash values are for known files.
They're use for eliminating known files from our case,
like Windows system files or
common files that come with your install of Windows 10.
They could be used for identifying files of interests,
files that we want to look at.
Suppose we were looking for a specific document,
may be in an IP theft case,
intellectual property theft case.
If we knew the file hash value
of the document we were looking for,
we might search for it on our suspect's computer.
It also helps us
identify the same files in different cases.
This could be true with malware.
If we know the value of a malware,
we could use that hash value to find
that specific malware on more than one computer.
It also helps us de-duplicate or
find duplicates in our cases.
We can eliminate the duplicate files,
and cut down our exam time.
Now, the NIST hash set,
these are known files.
They are like system files.
We can exclude authentic or genuine system files,
known software files,
known as negative hashing or de-NISTing.
There are several types of hash sets available online.
The National Institute of
Standards and Technology, or NIST,
for short, has a website you can
go to download this software reference library.
It's called the NIST NSRL library,
National Software Reference library.
What do we use the hash sets for?
We've already talked about finding files of interests.
Some cases, the example I gave was in IP theft.
But we could also use this for
illicit images or detecting child pornography.
We can search for any known file,
using its hash value.
We can create our own hash sets of files that
we are either interested in or we
want to eliminate from our view.
Most software will allow us to create custom hash sets,
and we're going to get to do that
in our walkthrough at autopsy.
We can import hash sets from one format to another,
but we might have to convert them.
This does have a conversion tool on its website,
which we will also download.
In our next module,
we're going to talk about hashing individual files.