Recipe Difficulty: Hard

Python Version: 2.7

Operating System: Linux

In this recipe, we create another triage script, this time focused on identifying files matching provided hash values. This script takes a text file containing MD5, SHA-1, or SHA-256 hashes, separated by a newline, and searches for those hashes within the evidence container. With this recipe, we will be able to quickly process evidence files, locate files of interest, and alert the user by printing the file path to the console.