Section 6 - Hash Lookup Lab


I am on’ Section 6 and am currently stuck on the lab. It told me to download the NSRL file from “”, however, when I unzipped the folder the file was named “NSRLFile-266m-computer.txt-md5.idx”

Where can I find the file that is named “NSRLComplete.txt-md5.idx”?

The file you downloaded is fine. The training leaves off the version number since it changes.

Okay, so I ran everything like it asked and it came back with 0 results for hash sets. I uploaded pictures

Here is another picture:

Did you enable the hash sets when you ran the ingest module?

Yes I did

During the ingest portion, there were only 6 files that showed up in the “hashset” and no directory. I noticed Autopsy crashed sometime and restarted it this morning and I’m re-running the ingest portion again.

Will this be a problem with the amount of data?

I see there is a “Ransom Case” notable hash set, but did you actually copy and paste the hash value into that hash set? You have to create the hash set, and then actually give it the data that it needs to search on. Creating just the hash set “Ransom Case” isn’t enough, because without data, the hash set is empty and will not generate any matches.