Piecewise hashing involves breaking a file into smaller, fixed-size blocks and hashing each block individually. This technique is useful for finding similarities between files, even when parts have been altered. The hashdeep tool is specifically designed for advanced forensic hashing and includes a function for block-based piecewise hashing, which is activated using the -p command-line flag. This allows an analyst to generate and compare hashes for individual segments of a disk image or file, which is not possible with standard hashing utilities.

A. md5sum is a standard utility that computes a single MD5 hash for an entire file. It does not support breaking the file into segments for hashing.

B. sha256sum functions similarly to md5sum but uses the SHA-256 algorithm. It performs whole-file hashing only and lacks any piecewise hashing capability.

C. md5deep is a related tool from the same suite as hashdeep, but hashdeep is the modern, more versatile program that officially incorporates piecewise hashing alongside multiple algorithm support.

1. Hashdeep Official Documentation (Man Page): The manual page for the hashdeep tool explicitly documents the piecewise hashing feature.

Reference: hashdeep(1) man page.

Quote: "-p - Piecewise hashing. Break the file into blocks of size. The output format is modified to include the block size." (This can be found in the standard Linux man pages for the hashdeep package or on its official project page).

2. University Courseware: Reputable computer science and cybersecurity programs cover advanced forensic tools

including the hashdeep suite.

Reference: Rochester Institute of Technology

CSEC-464: Computer Forensics

"Hashing" lecture notes.

Content: Course materials discuss the limitations of traditional hashing (MD5

SHA-1) for finding similar files and introduce advanced tools like the hashdeep suite

noting its capability for recursive and piecewise hashing in forensic investigations.

3. Academic Publication on Hashing Concepts: The concept of piecewise hashing is foundational in modern digital forensics for similarity analysis.

Reference: Roussev

V. (2011). "An evaluation of forensic similarity hashes." Digital Investigation

8

S34-S41. https://doi.org/10.1016/j.diin.2011.05.005

Content: This paper discusses various hashing methods used in digital forensics

including block-based hashing (as implemented by hashdeep) and context-triggered piecewise hashing

establishing the academic and practical basis for using such tools in investigations.