How do I import custom hash sets to create a custom KFF group?
- A text file containing a list of the desired hashes, saved as a *.csv or *.tsv. This can be created manually or by using "Export File List Info" in FTK, including only the desired hash column in your list (e.g. MD5, SHA1, etc.).
Note: You must include the hash type (MD5, SHA256, etc.) as the first line in the file.
[Leave an empty line (hard return) after the last hash]
- A HashKeeper (*.hke) file
- In FTK go to Manage > KFF and click "Import"
- Click "Add File"
- Select the Status for your custom hash set
- Browse to the file with your custom hash set (*.csv, *.tsv, *.hke)
- Give the hash set a name
- Specify a Source Vendor name, Version, and Package name
- Click "OK", then click "Import"
- Back in the KFF Admin dialog, under Defined Groups click "New"
- Give the group a name
- Select a "Status Override" (set to "None" to use the original sets' statuses)
- Highlight your new KFF set in the Available Groups/Hash Sets list and add it to your new group by clicking <<, then click "OK"
These steps will help you import a custom KFF hash set and create your own KFF group in FTK.