Description: hashdeep is a program to compute, match, and audit hashsets. With traditional matching, programs report if an input file matched one in a set of knows or if the input file did not match. It's hard to get a complete sense of the state of the input files compared to the set of knowns. It's possible to have matched files, missing files, files that have moved in the set, and to find new files not in the set. Hashdeep can report all of these conditions. It can even spot hash collisions, when an input file matches a known file in one hash algorithm but not in others. The results are displayed in an audit report.
source : http://md5deep.sourceforge.net/
this video explains how to use this tool. it is a forensics tool and already included in backtrack.
in video first "fdisk -l" is run to list the partitions and then hashdeep is used. following is syntax:
hashdeep -e /dev/sdc1 > /root/Desktop/hash.txt
Tags: hashdeep , tool , Hashing ,
Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.
this tool recursively calculates hashes and uses multiple algorithms simultaneously. in some cases (matching)it is more powerful than md5deep family of programs.
thanks for the video