Re: [sleuthkit-users] NSRL question

[Brian C. <ca...@sl...>]

On Jan 29, 2004, at 10:38 PM, Paul Stillwell wrote:

> Hi all,
>
> 	I just wrote a little script that does this.

Great.

> Autopsy's make uses it with the following output.  Any info
> on what the 2,602 errors might be and how I could eliminate them would  
> be
> appreciated.
[...]
> -------------- begin hfind output --------------
> Extracting Data from Database (/Forensics/NSRL/NSRLFile.txt)
>   Valid Database Entries: 17292990
>   Invalid Database Entries (headers or errors): 2602
>   Index File Entries (optimized): 16572711
> Sorting Index (/Forensics/NSRL/NSRLFile.txt-md5.idx)
> --------------- end hfind output ---------------

There is a header entry on top of all of the hash files.  It looks like  
(or similar depending on the format version):

"SHA 
-1","FileName","FileSize","ProductCode","OpSystemCode","MD4","MD5","CRC3 
2","
SpecialCode"

Those are considered 'invalid' and the NSRL site says there are over  
2600 sets, so they are probably from that.  Check out how many zip  
files you downloaded.

brian