NSRL Banner

NSRL Logo

HOME

GENERAL INFORMATION

TECHNICAL INFORMATION

CFTT Website

NSRL Site Statistics

Privacy Statement/Security Notice
Disclaimer | FOIA

NIST is an agency of the
U.S. Commerce Department's
Technology Administration.

Date created: 2/20/2004
Last updated:

Technical comments: nsrl@nist.gov

Website comments: web897@nist.gov

 

 

 

Archive of Previous Downloads

On this page, we will make links available to hashsets, to source code, and to executable tools produced by the NSRL.

ISO 9660 images of RDS CDs

If you have a fast Internet connection, you may download ISO 9660 image files and burn your own copy of the RDS CDs.

Be aware that the ISO image files range in size from 200MB to 500MB.

RDS 2.6 , September 2004

signatures of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

It is your responsibility to verify the ISO image files with the signatures and file sizes once they are downloaded. After you have used the image to create a CD, it is your responsibility to verify the data files on that CD with the signatures provided on that CD.

RDS 2.5 , June 2004

signatures of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

RDS 2.4 , March 2004

signatures and file sizes of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

RDS 2.3 , December 2003

signatures and file sizes of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

RDS 2.2 , September 2003

signatures and file sizes of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

RDS 2.1 , June 2003

signatures and file sizes of the four ISO images
disc 1 (non-English software)
disc 2 (operating systems)
disc 3 (application software)
disc 4 (images & graphics)

RDS 2.0 , March 2003

signature and file size of the one ISO image
disc 1 (complete collection)

RDS Version 2.3 Hashset Collection, December 2003

Over 2,600 hashsets are available here. Each hashset represents one product stored in the NSRL. You may download individual hashsets as described immediately below, or download them in bulk as described further below.

Hashsets are available in four formats, which should be useful in the majority of available forensics tools. The formats are RDS 1.x , RDS 2.x , Hashkeeper and ILook format. ILook is new as of Jan. 2004

Individual Hashset Downloads

To browse through the NSRL contents and download hashsets of single products, you can use these indices, sorted by:

The directory and filename convention are as follows:
formatXX/RDS-N-XX.zip - zip file with hashset and SHA-1/MD5 signatures of files in zip file
formatXX/RDS-N-XX.sha - SHA-1 signature of zip file
formatXX/RDS-N-XX.md5 - MD5 signature of zip file
where XX is "15", "20", "hk" or "il", signifying the format and N is a number, corresponding to the product code in the NSRL collection.

You can look up the application name and product code in the permuted index.

Bulk Hashset Downloads

If you wish to download a large number of files, you may use the "curl" or "wget" applications available for Windows, Unix/Linux and Mac platforms, or any web scraping program you prefer. You can specify several sets by using the naming convention above. If you want the entire 2,600 hashset collection, we ask that you restrict your bulk downloading to the hyperlinks on these pages:

If you previously performed a bulk download of RDS 2.1 (see below) and updated from 2.1 to 2.2, you may use these links for a bulk download of only the hashset updates to update from 2.2 to 2.3: If you previously performed a bulk download of RDS 2.1 (see below) you may use these links for a bulk download of only the hashset updates to update from 2.1 to 2.3:

An example script for using curl on Mac OS X to get all hashsets in RDS 1.5 format would be: 

curl http://www.nsrl.nist.gov/ftp/RDS_2.3/format15/index.html | grep 'RDS' |           \
    awk -F'\"' '{printf("curl --url http://www.nsrl.nist.gov/ftp/RDS_2.3/format15/%s --connect-timeout 60 --max-time 1800 -O \n",$2)}'   \
    > download-RDS-1.5-hashsets.sh
Cut and paste the 3 lines above into a file called "makecurl.sh", enter the command "sh makecurl.sh". This will build a new script called "download-RDS-1.5-hashsets.sh", enter the command "sh download-RDS-1.5-hashsets.sh" and this will download all of the zipped hashsets and the SHA-1 and MD5 signatures of the zip files.

You can replace "format15" with "format20" or "formathk" to download the RDS 2.x format or Hashkeeper format files. There are other curl options (resuming downloads, wait times, etc.) that you may wish to set other than in this example.
To silence curl (you may have many status messages), replace "-O" with "-O -s".

An example command using wget on Windows 2000 to get all Hashkeeper format hashsets would be: 

wget -t 2 -w 19 --recursive --level=2 http://www.nsrl.nist.gov/ftp/RDS_2.3/formathk/index.html
Again, there are other wget options that you may wish to set.

Note that these examples result in downloading over 2,600 zip files with the MD5 and SHA-1 sums of those zip files. This is a total of over 1 GB.

RDS Version 2.2 Hashset Collection, September 2003

If you previously performed a bulk download of RDS 2.1 (see below) you may use these links for a bulk download of only the hashset updates to update from 2.1 to 2.2:

RDS Version 2.1 Hashset Collection, August 2003

Over 2,400 hashsets are available here. Each hashset represents one product stored in the NSRL. You may download individual hashsets as described immediately below, or download them in bulk as described further below.

Hashsets are available in three formats, which should be useful in the majority of available forensics tools. The formats are RDS 1.x , RDS 2.x , and Hashkeeper format.

Individual Hashset Downloads

To browse through the NSRL contents and download hashsets of single products, you can use these indices, sorted by:

The directory and filename convention are as follows:
formatXX/RDS-N-XX.zip - zip file with hashset and SHA-1/MD5 signatures of files in zip file
formatXX/RDS-N-XX.sha - SHA-1 signature of zip file
formatXX/RDS-N-XX.md5 - MD5 signature of zip file
where XX is "15", "20" or "hk", signifying the format and N is a number, corresponding to the product code in the NSRL collection.

You can look up the application name and product code in the permuted index.

Bulk Hashset Downloads

If you wish to download a large number of files, you may use the "curl" or "wget" applications available for Windows, Unix/Linux and Mac platforms. You can specify several sets by using the naming convention above. If you want the entire 2,400 hashset collection, we ask that you restrict your bulk downloading to the hyperlinks on these pages:

An example script for using curl on Mac OS X to get all hashsets in RDS 1.5 format would be: 

curl http://www.nsrl.nist.gov/ftp/RDS_2.1/format15/index.html | grep 'RDS' |           \
    awk -F'\"' '{printf("curl --url http://www.nsrl.nist.gov/ftp/RDS_2.1/format15/%s --connect-timeout 60 --max-time 1800 -O \n",$2)}'   \
    > download-RDS-1.5-hashsets.sh
Cut and paste the 3 lines above into a file called "makecurl.sh", enter the command "sh makecurl.sh". This will build a new script called "download-RDS-1.5-hashsets.sh", enter the command "sh download-RDS-1.5-hashsets.sh" and this will download all of the zipped hashsets and the SHA-1 and MD5 signatures of the zip files.

You can replace "format15" with "format20" or "formathk" to download the RDS 2.x format or Hashkeeper format files. There are other curl options (resuming downloads, wait times, etc.) that you may wish to set other than in this example.
To silence curl (you may have many status messages), replace "-O" with "-O -s".

An example command using wget on Windows 2000 to get all Hashkeeper format hashsets would be: 

wget -t 2 -w 19 --recursive --level=2 http://www.nsrl.nist.gov/ftp/RDS_2.1/formathk/index.html
Again, there are other wget options that you may wish to set.

Note that these examples result in downloading over 2,400 zip files with the MD5 and SHA-1 sums of those zip files. This is a total of over 1.1 GB.

Hashing Code for Windows 2000 Platform

The code released in March 2003 was based on a Windows 2000 platform. The ISO 9660 image can be downloaded and used to burn a CD that can turn a Win2000 PC into a hashing platform that produces NSRL RDS format hashset files. This code does recursively open and process several "archive" file formats such as .CAB, .ZIP, .TAR, etc.
ISO image (56 MB)

You need a common Win2000 PC with internet access for some of the installation.

January 2004 - we have migrated our hashing environment to open source solutions. Any agency should be able to duplicate our hashing cluster with the limiting factor being the cost of CPUs. As testing of the new open source environment proceeds, we plan to create Knoppix-like boot media which will allow other agencies to duplicate our hashing cluster on existing CPUs without perturbing the original system's state. The download above will then be obsolete.

Hashing Code for Perl

The code released in May 2003 was completely in Perl and is extremely portable. This code does not recursively process archive files.
Zip file (8 KB)

You need a computer with Perl 5.6 or greater, and the ability to load Perl modules.

January 2004 - we have migrated our hashing environment to open source solutions. Any agency should be able to duplicate our hashing cluster with the limiting factor being the cost of CPUs. As testing of the new open source environment proceeds, we plan to create Knoppix-like boot media which will allow other agencies to duplicate our hashing cluster on existing CPUs without perturbing the original system's state. The download above will then be obsolete.

Code to convert RDS to Hashkeeper format

The code released in May 2003 was completely in Perl and is extremely portable.
Zip file (5 KB)

You need a computer with Perl 5.6 or greater, and the ability to load Perl modules.

January 2004 - we have migrated our hashing environment to open source solutions. Any agency should be able to duplicate our hashing cluster with the limiting factor being the cost of CPUs. As testing of the new open source environment proceeds, we plan to create Knoppix-like boot media which will allow other agencies to duplicate our hashing cluster on existing CPUs without perturbing the original system's state. The download above will then be obsolete.