Identifying almost identical files using context triggered piecewise hashing

Digital Investigation

Volumn 3, Issue SUPPL., 2006, Pages 91-97

  Kornblum, Jesse ^a  

^a ManTech SMA   (United States)

Author keywords

Forensics; Memory analysis; Microsoft; Reverse engineering; Windows

Indexed keywords

COMPUTER OPERATING SYSTEMS; DATA STORAGE EQUIPMENT; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS;

FORENSICS; MEMORY ANALYSIS; MICROSOFT (CO);

CRYPTOGRAPHY;

EID: 33746191665     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2006.06.015     Document Type: Article

References (10)

1. Allison L. Dynamic programming algorithm (DPA) for edit-distance (1999), Monash University. Available from: http://www.csse.monash.edu.au/∼simlloyd/tildeAlgDS/Dynamic/Edit/
2. Foster J.C., and Liu V.T. Catch me, if you can (2005), Blackhat Briefings. http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-foster-liu-upda te.pdf Available from:
3. Harbour N. Dcfldd (2002), Defense Computer Forensics Lab. http://dcfldd.sourceforge.net/ Available from:
4. Kornblum J. md5deep (2006). http://md5deep.sourceforge.net/ Available from:
5. Kornblum J. Ssdeep (2006). http://ssdeep.sourceforge.net/ Available from:
6. Lincoln A. Collected works of Abraham Lincoln. In: Basler R.P. (Ed) (1953), The Abraham Lincoln Association
7. Noll L.C. Fowler/Noll/Vo Hash (2001). http://www.isthe.com/chongo/tech/comp/fnv/ Available from:
8. Tridgell Andrew. Efficient algorithms for sorting and synchronization. PhD thesis. Canberra, Australia: Department of Computer Science, The Australian National University; 1999.
9. Tridgell A. Spamsum README (2002). http://samba.org/ftp/unpacked/junkcode/spamsum/README Available from:
10. White D. NIST National Software Reference Library (2005), National Institute of Standards and Technology. http://www.nsrl.nist.gov/ Available from: