1

Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole file (e.g. a PDF file consists of a trailer dictionary, a central directory stream, etc.), so does it take these elements into account? Or does it calculate the hash based only on the content of the file (but in the case of a PDF file, the content is compressed and stored in a binary file along with all other information , so how can the algorithm "extract" the content of the file in such a case?

1
  • For every extension (.pdf, .docx, etc) you need to open the file and read it as plain text. Most of the formats will be compressed, so most similarity hashes won't perform well.
    – oleksii
    Commented Jun 19, 2023 at 15:39

1 Answer 1

0

None of the three algorithms you mention has anything specific to file formats in their documentation, which suggests that they simply treat input as an unstructured binary stream.

Of course, when using these algorithms one can preprocess the input and apply the hashes to extracted information, like not applying the hash to a full mail itself but only to included attachments and texts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .