Re: [sleuthkit-developers] Sort in hfind

[Brian C. <ca...@sl...>]

On May 17, 2005, at 4:38 PM, Marcio Carneiro wrote:

> Hi!
>
> Have anyone had problems with sort in hfind to create the index file 
> for NSRL?
>
> I can't sort the MD5 index file, but I can sort the SHA1 index file!
> The message is like:
>
> sort: write failed: /tmp/sortKYlDin: No space left on device
>
> I don't understand why it happens only with the MD5 file, that has the
> same number of lines that the SHA1 file (12421779)!

  hfind uses the local 'sort' tool to sort the index file.  I think the 
NSRL files are already somewhat sorted by SHA1, but not fully (although 
I'm traveling and don't have access to the full database).  So, the 
SHA1 sorting does not need as many temporary files because less work 
needs to be done.  The MD5 sorting may need to duplicate the entire DB 
in temp files.

brian