Many thanks, this just cut the number of review fi...

2009-09-23T01:18:29.449-07:00

Many thanks, this just cut the number of review files in half

John

Lance, Here is a similar filter, with better perf...

2009-05-01T08:43:00.000-07:00

Lance,

Here is a similar filter, with better performance, using a suggestion by Shawn Mcreight on the GSI forum. Basically just uses a hash array rather than name class array, since hash comparisons are orders of magnitude faster than string comparisons. This is also easily modified to dedupe the entire case.

typedef HashClass[] HashArray;
class MainClass {
HashArray HashList;
SearchClass Search;
MainClass() :
HashList(),
Search()
{
}
bool Main(EntryClass entry) {
if (entry.IsSelected()) {
HashClass hash = Search.ComputeHash(entry);
if (HashList.Find(hash) == -1) {
HashList.Add(hash);
return true;
}
else
Console.WriteLine("Duplicate File:\t" + entry.FullPath() + "\t" + hash);
}
return false;
}
}

Thanks for the great resources available on your blog.

Brian Larsen

Comments on Computer Forensics, Malware Analysis & Digital Investigations: Filter to remove duplicates for export

Many thanks, this just cut the number of review fi...

Lance, Here is a similar filter, with better perf...