- Why does on-site triage still depend on the lab?
- Where do full-file hash comparison and manual review break down in the field?
- How does Block Hash Scan in MD-LIVE change the cost of identifying a file?
- And when a scan returns zero detections, what does that result tell you?
The Decision Cannot Wait for the Lab
Investigators need to judge at the scene whether a device is relevant to a case. The results needed to judge relevance arrive after the device is seized, imaged and reviewed in the lab.
Smartphone storage now exceeds 512GB, and a single device can hold tens of thousands of photos and videos. Imaging takes considerable time, and the wait grows with every additional device. Devices of unclear relevance end up seized, and the burden shifts to the examiners who process them.
Where Existing Field Methods Fall Short
Full-file hash comparison
- Compares a list of MD5 or SHA hash values against the hashes of files on the device.
- Requires reading every byte of a file. A 4GB video means reading 4GB.
- A device holding 300GB of media means transferring roughly 300GB over USB, so scan time grows with the amount of data stored.
Manual review
- At one second per image, 12,000 photos take 3 hours and 20 minutes.
- The risk of missing a file rises with volume.
- When the material is illegally filmed content, viewing it is itself a burden on the investigator.
Identifying a File Without Reading It in Full
Block Hash Scan, a feature of MD-LIVE, divides each file into fixed-size blocks and hashes each block. The scan reads only the blocks it needs and compares them against a block hash set (.mbh) prepared before deployment. With Block Hash Scan, identifying a 40GB video requires reading almost the same amount of data as identifying a 4GB one.
Where Block Hash Scan Fits Any case built on known target files
- CSAM investigations
- Corporate data and intellectual property theft
- Malware investigations
- Fraud and document investigations
What Does a Zero-Detection Result Tell You?
Reading only part of each file makes the matching criteria more lenient. Examiners will ask before trusting any result:
- If only some blocks are read, can a file registered in the hash set be missed?
- How should the result be treated if the scan is interrupted?
- What belongs in the case record when the scan reports zero detections?
The full article covers how the quick scan and full scan narrow a device to suspicious files, the conditions under which a zero-detection result holds, and a field checklist.
Read the full article here: Block Hash Scan: Illegal File Triage Completed On Site | GMDSOFT
