Reverse engineering Microsoft a b s t r a c t Homologous files share identical sets of bits in the same order. Because such files are not completely identical, traditional techniques such as cryptographic hashing cannot be used to identify them. This paper introduces a new technique for constructing hash signatures by combining a number of traditional hashes whose boundaries are determined by the context of the input. These signatures can be used to identify modified versions of known files even if data has been inserted, modified, or deleted in the new files. The description of this method is followed by a brief analysis of its performance and some sample applications to computer forensics.
Context Triggered Piecewise Hash (CTPH) scheme proposed by Kornblum REF was designed to identify modified versions of known files (not dedicated for hard disk) even if data have been inserted, modified, or deleted in the new files.
Identifying almost identical files using context triggered piecewise hashing
Digital Investigation
Digital Investigation
Computer Science