Compare md5 hash

Autopsy Help
1

Hi, I would need to use the program to search for video and image files within a disk or folder, comparing them with my hash set md5, as quickly as possible.
I did a lot of tests, but, after waiting a long time the bar at the bottom right was still at 1% … then going to look specifically, I saw that for each file it took a long time, while I was only interested in calculating his hash md5 and compared it to mine.
Please note that in the “Configure Ingest Modules” I left only “hash lookup” and “File type identification” selected, on the “run ingest modules on” I created my own search key based on the file extension.
How can I speed up the search operation since what interests me is only the match between my md5 hashes and those of the files (videos and images) present in the device / folder?
Sorry my english :slight_smile:
Thanks.

2

You could use a file filter that only runs ingest on files with image/video extensions.

http://sleuthkit.org/autopsy/docs/user-docs/4.18.0/ingest_page.html#file_filters

3

As already written on the post, I have already put the filters, the problem that for each file takes a long time, while it would be enough for me to verify the md5s with those of my database

4

It shouldn’t be doing anything except calculating hashes and file types so there’s not much more to do that will speed it up. Some options:

  • Go to Tools->Options. On the Ingest tab, make sure the ingest threads is set to the max recommended for your machine
  • Disable file type ID (though this tends to be very fast)
  • Also on the options panel, go to the Image Gallery tab and disable everything in the top section
5

I’m so sorry for the delay in answering but I’ve been on vacation for some days and I couldn’t test what you told me.
I made the changes that you recommended but unfortunately when I start a job it takes a long time to analyze the files, but I would not like him to do it, I would only be interested in him calculating the md5 of the file filters types I have included in the list “Ingest”.
Yesterday afternoon I started the program to analyze an 8Tb hd, I want to point out that my pc is quite powerful, it has 96 Gb of Ram, I left the pc on all night, and after 20 hours of work, the analyzing files, it is still at 2%.

6

thanks for the awesome information.

7

thanks my issue has been fixed.