Just a quick note to let people know about a couple of open utilities I've made.
Quick hash - A Linux and Windows GUI to enable the rapid selection and subsequent hashing of files, either individually or recursively throughout a folder structure, text and (on Linux) disks. Designed for Linux, but also available for Windows. SHA1, SHA256, SHA512 and MD5 available and all output can be copied to clipboard or saved as CSV\HTML file.
https://
eCryptfs Parser - eCryptfs Parser is a GUI for Linux and Windows that recursively parses the headers of every eCryptfs file found in a given directory. It will tell you what encryption algorithm was used, the original filesize, signature used etc. It is designed for use on a Linux box, but it will also traverse a Windows directory with such files exported into it from a forensic image, providing there are no other files contaminating them.
https://
I Have The Power - A Windows\Linux GUI for demonstrating the numerical enormity of large hash algorithms like MD5 (128 bits), SHA1 (160 bits), SHA256 (256 bits) and SHA512 (512 bits). Useful for demonstrations to non-technical audiences such as jury panels, school children, students and so on by converting the scientific notation of the algorithm to "The chance of two different files having the same hash are 1 in XXXX". I wrote it to help explain to my non-forensic colleagues why I can reliably filter out a duplicate, or a knowns system file etc.
https://
Ted
He.
Just tried today QuickHash 1.4 and it often said "not responding". I used half a terabyte of Exchange bkf files and PST files. Is there something in the code to be optimized?
I used a i7 notebook, x series from Lenovo. Files wereon an external 1TB USB hard disk.
Just driving again to the office to see if system and app is still alive and had done the job.
BitStorm
Thanks for trying out QuickHash.
I assume you were doing a recursive directory hash of many files in several directories? That being the case, the program will find the first file, hash it, update the grid display and percentage progress etc, then move to the next file. If it finds large files that might take a while, it will appear to be "Not Responding" during that execution. It probably just needed more time to hash the files. Especially if some of them are > 0.5Tb and double especially if they're on a USB drive connected via USB! That will take a long time for any program.
The percentage progress will increase with each file processed, so just keep an eye on that.
Ted
double especially if they're on a USB drive connected via USB
Not necessarily the newer Lenovo X series laptops have USB 3.0 )