The HashKeeper paradigm is a well known method for reducing workload when performing forensics examinations or file authentication. The problem is that the data files provided in most packages are not readily reprocessed because they're in the wrong format. The Maresware Hash Set DVD has solved that problem.

We have obtained the Hashkeeper hash sets (last ones are dated 2003) which comprise of about 700,000 hashes. We have merged these hashes with hashes provided by a federal agency in charge of standards. Thus providing significant more hashes than the Hashkeeper data sets.

The current Maresware hash-cd set (as of February 2008) contains over 13 million unique hash values from over 46 million files. These records have been converted to comma delimited fixed length records. That enables rapid processing in most database or spreadsheet programs.

As of Feb. 2008, the originating agency has provided over 13,000,000 unique hash values for software provided by various companies supplying voting machine software. These values are calculated from the original software supplied by the companies, and could be used in a validation process to maintain voting machine software integrity.

These converted records are easily processed by Maresware software as well as most any data base program that can import fixed length or comma delimited data.

For those who prefer to work with pure data, we also provide a file which contains only the hash values. This file is formatted as if it were a .csv file which means it can easily be imported into the KFF section of Forensic Toolkit. from Access Data. Call for information on how to accomplish this.

Those wishing to import the hash values into Encase will have to research the Encase requirements of .csv formats and possibly reform the data records to meet any special formats required.

What you get on our Hash Set DVD

Our Hash Set DVD contains.

• Copies of the original files from the government agency.
• The data records which were culled out of the data sets produced by the original source, and records from the HashKeeper program [numbers 1 thru 250 (as of 10/2002), with the exception of 200-228, which contain certain sets which are not appropriate to include in the main data set].

The original data records are reformatted to a fixed length record. See the link directly below for samples. This data is contained in four zip files:

• one with the CRC records.
• one with the SHA1 records
• one with the MD5 records
• one with only the MD5 values, suitable for import to KFF

Click these links to download via FTP a sample .doc document of:
CRC record,   MD5 record,   SHA record,   HashKeeper record.
The samples are small-- 3 records per file. You can download them, and see if they fit your processing needs.

Click these links to download actual data file samples. 50 records per file.
MD5 ONLY item. Imports into FTK cleanly.
MD5   record which should import into hashkeeper.

Current Statistics

Number of records in the sets:
HashKeeper: (sets 001->250) 767,871 records
Original source (v 2.9, 2/2008): over 46,000,000 (unique: 13,000,000+)
Combined Unique MD5 hashes: 13,000,000 (this includes hashkeeper, and voting software)

Estimated processing speed using Maresware:

Hash Set DVD contains batch files which allow Maresware users to compare the 12+ million unique records with a suspect set of 800,000 hashes in under 25 seconds(on a 1.2 GHZ machine). The batch files are also available for free in the FTP  directory called Hash_CD. Just download the zip files you find there.

Our Original Fields page contains the list of fields from the original source of the hash files. You will also find on our site sample records from the original source and our modified records, which have been modified to conform to fixed length format.

A reference page for algorithms and other documemts may be found at: NIST.  Research the documents link.

There are also some Linux hash sets available at www.fish.com. Pending permission, they will be incorporated into our set.

Top

Single Hash Set CD: $45. (U.S. Dollars)

Order: online
Or go to How to Order

This is a one-time purchase of the currently available files, in zipped format. This includes all the reformatted sets and some scripts for use with Maresware to increase the efficiency of processing these sets. The scripts are also free at the FTP site. (Note: in some instances, the hash sets on Hash Set CD are incorporated into Maresware: The Suite.)

Subscription $150. per calendar year. (Prorated for partial year; see below.)

Order: online
Or go to How to Order

This is a calendar year subscription for the data files. The zipped files are mailed on the DVD when you subscribe and each quarter thereafter.

Prorated prices for partial year subscriptions are as follows:

• If purchased in Jan - Mar: $ 150. (all prices in U.S. Dollars)
• If purchased in Apr - June: $ 120.
• If purchased in Jul - Sep: $ 80.
• If purchased in Oct - Dec: $ 45.

Order: online
Or go to How to Order

Learn about other validation tools from Maresware.