Ubuntu Manpage: ssdeep - Computes context triggered piecewise hashes

NAME

       ssdeep - Computes context triggered piecewise hashes

SYNOPSIS

       ssdeep [-m <file>] [-k <file>] [-vprdsblcxa] [-t val] [FILES]
       ssdeep [-V|h]

DESCRIPTION

Computes a checksum based on context triggered piecewise hashes for each input file. If requested, the
program matches those checksums against a file of known checksums and reports any possible matches. It
can also examine one or more of signatures and find any matches in those signatures. Output is written
to standard out and errors to standard error. Input from standard input is not supported.

-m <file>
Load the file of known hashes to be used for matching. This file must be a previous output of the
program and have the correct header. Displays only those files that match a known file and what
file they matched against. Although filenames may not contain Unicode characters, they can hold
hashes with Unicode filenames. May not be used with the -k or -x flags.

-k <file>
Compare the known signatures in the specified file to the pre-computed signatures in FILES. That
is, both the file specified here and the input FILES should contain fuzzy hashes already. This
flag can be used multiple times to load more known signatures. May not be used with the -m or -x
flags.

-v Verbose mode. The name of each file is printed to standard error as it is being hashed.

-p Pretty matching mode. Computes signatures for all input files and then display all matches between
files. That is, if file A matches file B, displays "A matches B" and "B matches A" but not "A
matches A". Each file's information is grouped and separated by newlines. This flag may be used
with the -m flag, but not the -d flag.

-r Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot
be used to examine all files of a given file extension. For example, invoking the program with -r
*.txt will examine all files in directories that end in .txt. If you want to process all files in
a directory tree with the .txt suffix, try using the find(1) command.

-d Enables directory mode. In this mode, all of the FILES are examined and a signature is computed
for each. If the signature for any files matches any of the previously computed signatures, a
match is displayed just like the -d mode. This flag may also be used in conjunction with the -m
mode, but with the -p mode.

-s Silent mode. All error messages are suppressed.

-b Enables bare mode. Strips any leading directory information from displayed filenames. This flag
may not be used in conjunction with the -l flag.

-l Enables relative file paths. Instead of printing the absolute path for each file, displays the
relative file path as indicated on the command line. This flag may not be used in conjunction with
the -b flag.

-c Enables comma separated output mode. In any of the matching modes -d, -p, or -m, displays the
results as input file, known file, matching score.

-x Enables signature file matching. The input FILES are assumed to contain ssdeep formatted
signatures. All of the signatures in these FILES are loaded into memory and compared against each
other. All matches are displayed, except for matches that have the same filename and come from the
same input file. May not be used with the -m or -k flags.

-a Displays all matches in any of the matching mode, regardless of score. Yes, this displays all
'matches', even if the match score is zero.

-t <val>
In any of the matching modes, only displays matches whose match score is above the given value.

-h Show a help screen and exit.

-V Show the version number and exit.

RETURN VALUE

       Returns  0  on  success,  1  if  there  is  a  problem.  Read errors, permission denied, and encountering
       directories while not in recursive mode are still considered successes. Problems are  things  like  being
       unable to load the matching file, specifying both bare and relative paths, etc.

AUTHOR

       ssdeep was written by Jesse Kornblum, ManTech International Corporation
       research (%at%) jessekornblum dott com

COPYRIGHT