Hash Database Lookup Module

What Does It Do

The Hash Database Lookup Module calculates MD5 hash values for files and looks up hash values in a database to determine if the file is known bad, known (in general), or unknown.

Configuration

The Hash Database Management window is where you can set and update your hash database information. Hash databases are used to identify files that are 'known'.

• Known good files are those that can be safely ignored. This set of files frequently includes standard OS and application files. Ignoring such uninteresting-to-the-investigator files, can greatly reduce image analysis time.
• Known bad (also called notable) files are those that should raise awareness. This set will vary depending on the type of investigation, but common examples include contraband images and malware.

Notable / Known Bad Hashsets

Autopsy allows for multiple known bad hash databases to be set. Autopsy supports the following formats:

• EnCase: An EnCase hashset file.
• MD5sum: Output from running the md5, md5sum, or md5deep program on a set of files.
• NSRL: The format of the NSRL database.
• HashKeeper: Hashset file conforming to the HashKeeper standard.

Adding Hashsets

Autopsy needs an index of the hashset to actualy use a hash database. It can create the index if you import only the hashset. When you select the database from within this window, it will tell you if the index needs to be created. Autopsy uses the hash database management system from The Sleuth Kit. You can manually create an index using the 'hfind' command line tool or you can use Autopsy. If you attempt proceed without indexing a database, Autopsy will offer to automatically produce an index for you. You can also specify only the index file and not use the full hashset - the index file is sufficient to identify known files. This can save space. To do this, specify the .idx file from the Hash Database Management window.

Using Hashsets

There is an ingest module that will hash the files and look them up in the hashsets. It will flag files that were in the notable hashset and those results will be shown in the Results tree of the Tree Viewer. Other ingest modules are able to use the known status of a file to decide if they should ignore the file or process it. You can also see the results in the File Search window. There is an option to choose the 'known status'. From here, you can do a search to see all 'known bad' files. From here, you can also choose to ignore all 'known' files that were found in the NSRL. You can also see the status of the file in a column when the file is listed.

NIST NSRL

Autopsy can use the NIST NSRL to detect 'known files'. The NSRL contains hashes of 'known files' that may be good or bad depending on your perspective and investigation type. For example, the existence of a piece of financial software may be interesting to your investigation and that software could be in the NSRL. Therefore, Autopsy treats files that are found in the NSRL as simply 'known' and does not specify good or bad. Ingest modules have the option of ignoring files that were found in the NSRL.

To use the NSRL, you may download a pre-made index from http://sourceforge.net/projects/autopsy/files/NSRL. Download the NSRL-XYZm-autopsy.zip (where 'XYZ' is the version number. As of this writing, it is 247) and unzip the file. Use the "Tools", "Options" menu and select the "Hash Database" tab. Click "Import Database" and browse to the location of the unzipped NSRL file. You can change the Hash Set Name if desired. Select the type of database desired, choosing "Send ingest inbox message for each hit" if desired, and then click "OK".

The screenshot below shows an imported NSRL.

Using the Module

Ingest Settings

When hashsets are configured, the user can select the hashsets to use during the ingest process.

Seeing Results

Results show up in the tree as "Hashset Hits", grouped by the name of the hash set.