Menu

#171 hfind doesn't recognize hash db it created

closed-invalid
nobody
Hash Tools (3)
5
2011-03-10
2011-03-06
John Lehr
No

I downloaded the latests NSRL set, concatenated the NSRLFile.txt, and removed repeated hashes with uniq. I created an nsrl-md5 db with 'hfind -i nsrl-mdr NSRLFile.txt' resulting in a NSRLFile.txt.uniq-md5.idx that contains two pipe delimited columns, the first '00000000000000000000000000000000000000000|nsrl'

When I attempt a hash comparison with hfind or sorter, i get the following error: 'Cannot determine hash database type (hdb_open: Error determining DB type)'

Sleuthkit 3.2.1, Debian Testing

Discussion

  • John Lehr

    John Lehr - 2011-03-10

    hfind improperly deployed by user.

     
  • John Lehr

    John Lehr - 2011-03-10
    • status: open --> closed-invalid
     

Log in to post a comment.

MongoDB Logo MongoDB