Importkff IPED 4.0.0

[fabriciossouza13]

Boa tarde.

Estou tentando realizar a importação do NSRL para o IPED 4.0.0 e, ao que parece, não há o parâmetro -importkff nesta versão. Executei o comando iped.exe --ajuda e não vi o parâmetro disponível.

Como poderia realizar esta importação?

[wladimirleite]

In 4.0.0 hashes are handled in a different way.
There is a short document describing but it is not available in the project's Wiki yet.

Try running java -jar lib/iped-hashdb.jar.

[wladimirleite]

@lfcnassif, can I try creating a Wiki page explaining how to deal with hashes in 4.x? (Highlighting that is for the new version only).
Or is it better to wait until the new version is released?

[lfcnassif]

@lfcnassif, can I try creating a Wiki page explaining how to deal with hashes in 4.x? (Highlighting that is for the new version only).
Or is it better to wait until the new version is released?

I think the wiki page can already be created, since users are able to build 4.0.0 from master (the default branch) or download a snapshot of it.

[lfcnassif]

And possibly the iped-hashdb.jar could be moved to root folder before the final release.

[fabriciossouza13]

No 4.0.0, os hashes são tratados de maneira diferente. Há um pequeno documento descrevendo, mas ainda não está disponível no Wiki do projeto.

Tente correr java -jar lib/hashdb.jar.

Vou tentar este comando. Contudo, no wiki recomenda a utilização do importkff.

[wladimirleite]

Vou tentar este comando. Contudo, no wiki recomenda a utilização do importkff.

Yes, the new way is not in the Wiki.

[fabriciossouza13]

O comando na versão 4.0.0 é: java -jar lib/iped-hashdb.jar -d "caminho do NSRLFile.txt" -o "caminho para gerar o db"

[wladimirleite]

I just added a section to Wiki's User Manual page, with an initial version of a description about hashes database in IPED 4.0.0 version:
https://github.com/sepinf-inc/IPED/wiki/User-Manual#hashes-database-version--400

[lfcnassif]

Great, thank you @tc-wleite!