Re: [sleuthkit-users] hfind?

[Brian C. <ca...@sl...>]

Hi Martin,

I just verified it on a Linux system and made the fix.  It only happens when '-l' is being used in sorter and on some systems.  One of the challenges is that different systems have different outputs for md5 or md5sum.  The fix will be in the next release. If you want it sooner, you can grab:

http://svn.sleuthkit.org/repos/sleuthkit/branches/sleuthkit-3.1/tools/sorter/sorter.base

and put it in tools/sorter.  Redo 'make' and 'make install' and you should be good.  I'm going to do a release by the end of the month. 

thanks,
brian


On Mar 18, 2010, at 11:13 AM, Brian Carrier wrote:

> Hi Martin,
> 
> I'm a little confused. Did you change sorter to use md5deep instead of md5sum or did you change the tool that you created the database file with?
> 
> thanks,
> brian
> 
> 
> On Mar 18, 2010, at 5:57 AM, mkoopmans wrote:
> 
>> I fixed it by using md5seep in stead of md5sum.
>> Now sorter works ok!
>> 
>> regards,
>> 
>> Martin
>> 
>> Stefan Kelm wrote:
>>> Hoi Martin,
>>> 
>>> 
>>>> Invalid argument (hdb_lookup: Invalid hash length:
>>>> 4afdaf202c34d9912cc6cd8806a66014  -)
>>>> 
>>> 
>>> what OS are you using? This looks similar to a problem I had
>>> running Autopsy w/ Debian. Have a look at the archive for this list
>>> and search for "Autopsy not displaying lookup button".
>>> Maybe it'll help.
>>> 
>>> Cheers,
>>> 
>>> 	Stefan.
>>> 
>>> 
>> 
>> 
>> -- 
>> M.B. Koopmans
>> 
>> Regiopolitie Hollands-Midden
>> Forensische Opsporing
>> Digitale Expertise
>> 
>> T: 071-5459327
>> F: 071-5459844
>> M: 06-46157206 (990997)
>> E: mko...@ph... 
>> E: mar...@ho... (no attachements)
>> PGP public key:
>> http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&search=0x9A9678FE775A0AE2
>> 
>> 
>> ------------------------------------------------------------------------------
>> Download Intel® Parallel Studio Eval
>> Try the new software tools for yourself. Speed compiling, find bugs
>> proactively, and fine-tune applications for parallel performance.
>> See why Intel Parallel Studio got high marks during beta.
>> http://p.sf.net/sfu/intel-sw-dev
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> Download Intel® Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org