Re: [sleuthkit-users] NSRL question

[Brian C. <ca...@sl...>]

>> There is a header entry on top of all of the hash files.  It looks 
>> like
>> [...]
>> Those are considered 'invalid' and the NSRL site says there are over
>> 2600 sets, so they are probably from that.  Check out how many zip
>> files you downloaded.
>
> Cool... Although, I have 2,603 files, and 2,602 errors.  Does hfind 
> ignore the
> first error by default because it expects at least one at the top of 
> the
> file?

Yea, it reads the first entry to get the database format version and 
then ignores it. I just updated the code to add that entry to the final 
number of ignored entries.

brian