How do I search for files based on a list of hash values

Question

As part of a company legal case I have been asked for search for any file that matches a list of SHA and MD5 hash values. How do I do that?

Answer 1

Using FileLocator Pro here are the steps to search by hash value.

Step 1: Create a text file with the list of hash values you wish to search for, e.g. a text file called:
e:\my-hashes.txt

CD06F2DB6BB60AD9346143AFFF99461A36D86ED6 
57B359BA6BA0FB10792BDB01B5AA04BA11597F25 
FDFA50F2D6C25434CA0B37AC652CF6D3D863199C 
BA932FBBE34A3E76CCFC4C74755A5B64AB79119E 

Step 2: Select the hash algorithms that you are matching against in the Configuration settings:

Step 3: Create the search loading the hash file.

Step 4: Run the search.

I recommend that you first test your search on a small sub folder with some known hits before trying to run the search on a large folder. Also to speed up the search you can limit the file hashing to certain file types using the File name field, e.g. to match the hashes for only DOC and DOCX files you'd use something like this:

File name: *.doc;*.docx

---

More information

You don't have to use a text file, you can instead specify a comma separate list of values in the Containing text field, e.g.

Containing Text: CD06F2DB6BB60AD9346143AFFF99461A36D86ED6,57B359BA6BA0FB10792BDB01B5AA04BA11597F25,FDFA50F2D6C25434CA0B37AC652CF6D3D863199C,BA932FBBE34A3E76CCFC4C74755A5B64AB79119E

Related question: Searching for an image