HashDB Filter Know Hashs

[thiagofuer]

Hi folks
I'm analysing my evidence processing result using iped-hashes.db, created using the nist RDS V3 Android Minimal
I've set the 'hashesDB' propertie on LocalConfig.txt
-hashesDB = /home/thiago/Downloads/nist/android_hash/ipedhashdb/iped-hashes.db
i've enabled the follow properties on IpedConfig.txt
-enableHash = true
-enableHashDBLookup = true
-ignoreDuplicates = true

so i've process an Android extraction using iped 4.1.2
when processing i saw some ignored itens

and got 90.337 files as restult:

I tryed to filter my results to show only the know hash results and i got the same total files

The question is: How can i see the "Ignored itens"? or how to filter the know hash files?

So i did the same processing using iped 4.0.1
I saw less files (80.911), but i can understando because this process has diferent enabled/disabled parsers

After use the filter "know hash results" i got 79.871 files..

and now I understood that the files that have the known hash were filtered out
but now another question has arisen...
the filtered file dont appears to be a android know hashdb file..

So please could anyone help me to understood how to filter the know hashDB?

[lfcnassif]

Hi @thiagofuer,

The "Filter Known Hashes"/"Filtrar Hashes Conhecidos" filter removes from result set the known files. If you want the opposite behavior (list known files), you can create a new filter negating the expression of the default one, take a look at "Manage Filters" menu entry in the Options button at top-right.

About the same number of results got after applying the filter in the first case, probably the "excludeKnown" option in conf/HashDBLookupConfig.txt was set to true in the used profile. Probably it was set to false (default value) in the processing using version 4.0.1.

About the last screenshot, as I said, the listed files are not known, the known files were filtered out (as you also said).

[thiagofuer]

thanks for the reply, i will try it again

[lfcnassif]

As a side note, please see the ignoreDuplicates option is very dangerous, you can miss many email attachments, that is warned in IPEDConfig.txt. I considered the removal of that option in the past but didn't after some users asked to keep the option, regardless of its risks...

[thiagofuer]

I've disabled the ignoreDuplicates and excludeKnown and now i can see the know files

Another question... whats the sintax used on filters?

[lfcnassif]

The same used by the search bar (Lucene).

[thiagofuer]

thanks a lot