Using Triage Mode Output as Known Files

[jessek]

The programs should be able to accept Triage mode output files as files of known hashes. Ideally, output generated by the programs in -Z mode should be acceptable as input. Example:

$ sha256deep -Z * > ../known.txt $ sha256deep -m ../known.txt foo.txt bar.txt

[AngoGonTal]

Hi there!

within the last three months its the 2nd time, I'ld like to use the triage mode, which is described in the manpage for the -Z argument:

-Z
Produces output in Triage format. Each line contans the file’s size, a tab, a hash of the first 512 bytes, a tab, the hash of the complete file, a tab, and the file name. These values are intended in increasing order of specificity. That is, two files with different sizes cannot possibly match. This is a fast comparison and should be done first. Next, two files with different partial hashes cannot possibly match. This is often faster than hashing the whole file. Finally, if those two pieces align, then it’s worth reading and hashing the entire file.

The description sounds like a perfect gadget. Unfortunately I only find the option to generate the output. So I wonder whether there is any app to use such triage file? Is there any chance, that the described routine is going to be implemented in the hashdeep cli tools?

Thanks in advance.