HFIND(1)

🦋 hfind — straight outta the General Commands Manual 🦋

okay so hi bestie 💖 you just opened the page for hfind, the (1) General Commands Manual girlie from the Sleuth Kit household. she's lowkey a genius: she looks hashes up in databases at actual lightspeed and tells you whether a file is known or not. let's get into it. no cap. ✨

---

✨ NAME ✨

hfind — look up a hash value in a hash database. that's it, that's the whole vibe 💅

---

🌸 SYNOPSIS 🌸

hfind [-i db_type ] [-f lookup_file ] [-eq] db_file [hashes]

---

🎀 DESCRIPTION 🎀

okay so here's the tea ☕ hfind looks up hash values in a database using a binary search algorithm. this means you can easily make a hash database and then figure out whether a file is known or not, fr fr. it works with the NIST National Software Reference Library (NSRL) and with the output of md5sum. iconic behavior honestly.

but bestie, before the database can be used by hfind, an index file must be created with the -i option. no index, no lookups, periodt.

this tool exists purely for efficiency, and that's the main character energy of it. most text-based databases don't have fixed-length entries and are sometimes not even sorted 😭. the hfind tool will create an index file that is sorted and does have fixed-length entries. that's what lets it do fast lookups with a binary search algorithm instead of a linear search like grep. it's giving glow-up. 🦋

---

🍓 ARGUMENTS 🍓

• -i db_type — create an index file for the database. 🫶 this step must be done before a lookup can be performed. the db_type argument tells you which database type it is (i.e. nsrl-md5 or md5sum). see the section below, bestie. ⬇️
• -f lookup_file — specify the location of a file that contains one hash value per line. those hashes get looked up in the database. 📄
• -e — extended mode. additional information besides just the name gets printed. (does not apply for all hash database types 🙈)
• -q — quick mode. instead of showing the corresponding information with the hash, it just shows 0 if the hash was not found and 1 if it was. ⚡ if you use this flag, then only one hash can be given at a time. that's the rule, no exceptions.
• -V — display version 👑
• db_file — the location of the hash database file. 📁
• [hashes] — the hashes to look up. if they're not supplied on the command line, STDIN is used. and if index files exist for both SHA-1 and MD5 hashes, then both types of hashes can be given at runtime. dual-wielding energy 🌈

---

🧚 INDEX FILE 🧚

hfind uses an index file to perform a binary search for a hash value. this is so much faster than using grep, which does a linear search (aka the slow way, the walking-through-mud way 🐌). before a hash database is used, a corresponding index file must be created. this is done with the -i option to hfind. no shortcuts, bestie.

the resulting index file will be named based on the database file name. the name will have the original name followed by the hash type (sha1 or md5) followed by .idx. for example, creating an MD5 hash index of the NIST NSRL results in NSRLFile.txt-md5.idx and the SHA-1 index results in NSRLFile.txt-sha1.idx. cute, consistent, obsessed. 💖

the file has two columns. each entry is sorted by the first column, which is the hash value. the second column has the byte offset of the corresponding entry in the original file. so when a hash is found in the index, the offset is recorded and then hfind seeks to the entry in the original database. it's giving GPS for bytes 🗺️

the following input types are valid. for NSRL, nsrl-md5 and `´nsrl-sha1' can be used. the difference is which hash value the index is sorted by. the md5sum value can also be used to sort and index "home made" databases. 🍪 hfind can take data in both common formats:

MD5 (test.txt) = 76b1f4de1522c20b67acc132937cf82e

and

76b1f4de1522c20b67acc132937cf82e        test.txt

---

🔥 EXAMPLES 🔥

to create an MD5 index file for NIST NSRL:

# hfind -i nsrl-md5 /usr/local/hash/nsrl/NSRLFile.txt

to look up a value in the NSRL:

# hfind /usr/local/hash/nsrl/NSRLFile.txt
76b1f4de1522c20b67acc132937cf82e

    76b1f4de1522c20b67acc132937cf82e  Hash Not Found

you can even do both SHA-1 and MD5 if you want, because why choose 🌈

# hfind -i nsrl-sha1 /usr/local/hash/nsrl/NSRLFile.txt

# hfind /usr/local/hash/nsrl/NSRLFile.txt
76b1f4de1522c20b67acc132937cf82e
80001A80B3F1B80076B297CEE8805AAA04E1B5BA

76b1f4de1522c20b67acc132937cf82e  Hash Not Found

80001A80B3F1B80076B297CEE8805AAA04E1B5BA  thrdcore.cpp

to make a database of critical binaries of a trusted system, use md5sum:

# md5sum /bin/* /sbin/* /usr/bin/* /usr/bin/* /usr/local/bin/* /usr/local/sbin/* > system.md5

# hfind -i md5sum system.md5

to look entries up, the following will work:

# hfind system.md5 76b1f4de1522c20b67acc132937cf82e

76b1f4de1522c20b67acc132937cf82e  Hash Not Found

or

# md5sum -q /bin/* | hfind system.md5

928682269cd3edb1acdf9a7f7e606ff2  /bin/bash

<...>

or

# md5sum -q /bin/* > bin.md5

# hfind -f bin.md5 system.md5

928682269cd3edb1acdf9a7f7e606ff2  /bin/bash

<...>

---

🌈 SEE ALSO 🌈

• sorter(1) 👀
• the NIST National Software Reference Library (NSRL) can be found at www.nsrl.nist.gov. go look, bestie 🫶

---

💜 LICENSE 💜

distributed under the Common Public License, found in the cpl1.0.txt file in the The Sleuth Kit licenses directory. read it, love it, respect it ✨

---

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org> — the icon, the legend, the blueprint 💅

send documentation updates to <doc-updates at sleuthkit dot org> 📬

---

and that's the whole page, bestie 🎀 she signs off at the bottom with a lil' HFIND(1) and nothing else — no extra version drama, no date stamp, just that tidy little footer to close the vibe check. slay. 🌸🦋💖