## 2 Related Work  
### Hash-Based Search  
Searching for files using hash values is one of the most typical investigative methods in forensics. Related studies [7; 8; 9; 10] have focused on fast file searches based on hash values. [PERSON] et al. [7] suggested the HASH-SETS algorithm to determine whether a particular file exists and the HASH-RUNS algorithm for reassembling files through a file block hash database. Both algorithms solve the problem of non-verification blocks and provide the results for analyzers who find target data in the searched media. However, if an encrypted file system is included in the media, these algorithms need to decrypt the file system first to access unencrypted blocks. In terms of forensic identification, [PERSON] et al. [8] and three others proposed a sector hash for target file detection, which is aimed at finding individual file blocks in disk sectors, rather than searching for individual files in a file system. By hashing the individually sampled main drive-in sector boundaries first and then comparing them with an already established database, it is possible to process raw media with no reference to a basic file system. However, this method has the limitation of selecting a proper file block size that needs to balance the file identification function. [PERSON] et al. [9] conducted a post-investigation of digital crimes in the Telegram messenger of Android devices and analyzed residual data that can be used as digital evidence of cybercrimes. In particular, the researcher used SHA-1 as a hash function to analyze the content of digital crimes along with the probabilities of criminal cases and to enhance the legitimacy of digital evidence in a court of law. The author suggested using it as the query data in forensic investigations and as query data of analysis related to the residual data search of cybercrime cases. When a sector-based scan is applied to recover the remaining fragments of illegal files in digital storage, a brute-force attack requires a time-consuming approach. For this reason, to accelerate the process, [PERSON] [10] proposed a technique for calculating and comparing the hash-based signature of a sector. Similar to the studies on hash function-based file identification [7; 8; 9; 10], this study also aims to identify files quickly among massive data. However, in the case of video files, if their original files are edited even slightly, their hash values are changed completely, making it difficult to identify original and manipulated criminal videos. Unlike previous papers, this paper proposes a method that identify similar videos regardless of whether the meta value of the file is encrypted or not. The study by [PERSON] et al. [9] is consistent with this study in that research is conducted on the assumption that digital crime content is widely distributed over Social media. The present study, However, if the distributed video is an edited video rather than an original video, it is difficult to find all related crime videos through hash-based research. The method proposed in this paper is a study comparing histogram similarity between videos, rather than using hash value that completely changes even if only one bit is different. Therefore, if the appropriate threshold is selected, other related similar crime videos are also possible for identification, revealing the remaining crimes of the suspect. In other words, it differs from previous papers in that it is able to identify not only the original video but also manipulated video.