Technical comments: email@example.com
Website comments: firstname.lastname@example.org
Introduction to the NSRL
to the NSRL
page provides a general overview of the NSRL: what it is; what it's for;
and how it's used. If you're new to the NSRL, this is a good place to
is the NSRL?
NSRL is The National Software Reference Library, based out of the National
Institute of Standards and Technology, an agency of the U.S.Department
of Commerce. It has three components:
What's in the
The NSRL RDS contains
metadata on computer files which can be used to uniquely identify the
files and their provenance. For each file in the NSRL collection, the
following data are published:
The RDS is distributed
as a collection of UTF-8 text files on a set of 4 CDs. Each file contains
a set of records, one record per line, consisting of comma-separated fields.
Details of the record formats can be found here
What is the NSRL
The data published
by the NSRL is used to rapidly identify files on computer systems, based
solely on the content of the files.
In most cases, NSRL file data is used to eliminate known files, such as operating system and application files, during criminal forensic investigations. This reduces the number of files which must be manually examined and thus increases the efficiency of the investigation.
However, the data can just as easily be used to target files of interest. Such uses include detection of unauthorized software installations (e.g., in corporate or web hosting environments or in intellectual property disputes), and discovery of exculpatory evidence by criminal defense teams.
Who uses the NSRL?
The primary focus
of the NSRL is to aid computer forensics examiners in their investigations
of computer systems. The majority of NSRL stakeholders are in federal,
state and local law enforcement in the United States and internationally.
These organizations typically use the NSRL data to aid in criminal investigations,
as outlined above. Other stakeholders include businesses and other government
agencies which may use the NSRL RDS as part of their routine IT operations.
How is the NSRL
Typically the RDS
data is imported into one of a number of commercial software packages.
How can I get
the NSRL data?
NSRL CD releases
are available via an annual
Each release is made
available for free download
one month after subscribers receive the CD sets.