ForensicTools/GRREAT-475_2141-Chaigon-Failey-Siebert — pull request #6 by pchaigno (2014-11-24 00:28:15+00:00)
Title: Proof of concept for a search by ssdeep hash

The GRREAT folder contains two scripts.

`find_by_hash.py` is a proof of concept of search by ssdeep hash. It can take one hash or a file containing hashes. By default, partial matches are not included. Thus, the search can be optimized [by approximating the size of the files](https://github.com/pchaigno/GRREAT-475_2141-Chaigon-Failey-Siebert/blob/d2fb3c0ff800bc15f2c7541d4de7f820c5ff671c/GRREAT/find_by_hash.py#L80-L84) to find (based on the blocksize). They can also be included with the option `-p` or `--partial-matches`.

The second script, `format_NSLR_file.pl` is a Perl script to convert the [complete ssdeep whitelist from NSLR](http://www.nsrl.nist.gov/ssdeep.htm) into a file the first script can read (only remove the SHA-1 hash).

Results from the optimization on a quad-core computer at 2.5GHz:

| Search for one hash | Search for 9 hashes
-------------------------- | -------------------------- | -------------
With partial matches | 2min8s | 2min10s
Optimized | 0.1s | 5s