NAME

hashdig-bind.pl - Bind resolved hashes to filenames

SYNOPSIS

hashdig-bind.pl [-qr] [-a hash-type] [-d delimiter] [-h hash-field] [-n name-field] -t file-type -f {hashdig-file|-} file [file ...]

DESCRIPTION

This utility binds resolved hashes to filenames. The source of resolved hashes is a HashDig file or stdin, and the source of filenames is one or more subject files. Depending on the type of subject files (see -t option), one or more of the following output files will be created in the current working directory: (a)ll, (d)irectory, (i)ndeterminate, (k)nown, symbolic (l)ink, (s)pecial, and (u)nknown. These files will have the following format:

    <filename>.bound.{a|d|i|k|l|s|u}

The 'all' file is the sum of the other output files.

OPTIONS

-a hash-type

Specifies the type of hashes that are to be bound. Currently, the following hash types (or algorithms) are supported: 'MD5', 'SHA1', and 'SHA256'. The default hash type is that specified by the HASH_TYPE environment variable or 'MD5' if HASH_TYPE is not set. The value for this option is not case sensitive.

-d delimiter

Specifies the input field delimiter. This option is ignored unless used in conjunction with the GENERIC data type. Valid delimiters include the following characters: tab '\t', space ' ', comma ',', semi-colon ';', and pipe '|'. The default delimiter is a pipe. Note that parse errors are likely to occur if the specified delimiter appears in any of the field values.

-h hash-field

Specifies the name of the field that contains the hash value. This option is ignored unless used in conjunction with the GENERIC data type. The default value for this option is "hash".

-n name-field

Specifies the name of the field that contains the name value. This option is ignored unless used in conjunction with the GENERIC data type. The default value for this option is "name".

-f {hashdig-file|-}

Specifies the name of a HashDig file to use as the source of hashes. A value of '-' will cause the program to read from stdin. HashDig files have the following format:

    hash|category
    

-q

Don't report errors (i.e., be quiet) while processing files.

-r

Accept HashDig records in reverse format (i.e., category|hash).

-t file-type

Specifies the type of subject files that are to be processed. All files processed in a given invocation must be of the same type. Currently, the following types are supported: FTIMES, FTK, GENERIC, KG|KNOWNGOODS, MD5, MD5DEEP, MD5SUM, OPENSSL, SHA1, SHA1DEEP, SHA1SUM, SHA256, SHA256DEEP, and SHA256SUM. The value for this option is not case sensitive.

CAVEATS

This utility attempts to load all hash/category information into a pair associative arrays. When all available memory has been exhausted, Perl will probably force the script to abort. In extreme cases, this can produce a core file.

AUTHOR

Klayton Monroe

SEE ALSO

ftimes(1), hashdig-dump(1), hashdig-harvest(1), hashdig-harvest-sunsolve(1), md5(1), md5sum(1), md5deep(1), openssl(1)

LICENSE

All documentation and code are distributed under same terms and conditions as FTimes.