Practical use of Approximate Hash Based Matching in digital investigations

  title={Practical use of Approximate Hash Based Matching in digital investigations},
  author={Petter Christian Bjelland and Katrin Franke and Andr{\'e} {\AA}rnes},
  journal={Digital Investigation},
Approximate Hash Based Matching (AHBM), also known as Fuzzy Hashing, is used to identify complex and unstructured data that has a certain amount of byte-level similarity. Common use cases include the identification of updated versions of documents and fragments recovered from memory or deleted files. Though several algorithms exist, there has not yet been an extensive focus on its practical use in digital investigations. The paper addresses the research question: How can AHBM be applied in… CONTINUE READING
2 Citations
14 References
Similar Papers


Publications referenced by this paper.
Showing 1-10 of 14 references

Network forensics: tapping the internet

  • S. Garfinkel
  • 2002
Highly Influential
4 Excerpts

Implementation and benchmarking of perceptual image hash functions [Master’s thesis

  • C. Zauner
  • Hagenberg Campus: Upper Austria University of…
  • 2010
2 Excerpts

PDFStreamDumper project page index.php?uid1⁄47&pid1⁄457

  • D. Zimmer
  • 2010
1 Excerpt

Binary codes capable of correcting deletions , insertions and reversals

  • VI Levenshtein
  • 2006

Similar Papers

Loading similar papers…