A quick utility I cobbled together may be of interest to any users who have involvement with the NSRL Hash Sets.
The program is designed to take the original NSRL hash set as downloaded from the NIST website, and converts it to a single file containing just a column of hashes that you have asked for. The output file can then be injested directly into whatever tool or purpose you have a need for it.
It saves a new output file that contains only the column of hashes you require, suitably formatted for immediate injestion into a digital forensic or other data analysis tool.
NSRL Stripper Program
NSRL Hash Set Before and After stripping with NSRL Stripper
Note that this utility is NOT needed for X-Ways Forensics because it is already intelligent enough to work out from your initialised hash database what values to import. i.e. if you initialised your hash database as SHA-1, it will injest only the SHA-1 values anyway. But other tools do not always do this. In other words, XWF does for you, automatically, what this tool does manually. But you may not be fortunate enough to own a license of XWF and the NSRL hash databases are so large that even tools like Excel, LibreOffice Calc and Notepad++ will fail to open all the millions of lines making it challenging for you to extract just the SHA-1, or MD5 or CRC values into a single column. Or you may just need to use something else as well as X-Ways Forensics, in which case a tool like this may be of use to you.
It is a single executable file – just double click it to launch after downloading it. No DLL, no installation needed, no Java Run Time Environment to be installed, no Python Interpreters needed. It is also open source.
The project homepage can be found at https://github.com/tedsmith/NSRL-Stripper
The first and, to date, the only release (for Windows and Linux…no OSX version yet) can be found at https://github.com/tedsmith/NSRL-Stripper/releases
Leave a Reply