nsrllookup
A command-line tool for digital forensics that checks file MD5 hashes against the NSRL Reference Data Set to identify known software files.
What is nsrllookup?
nsrllookup is a command-line tool that checks MD5 file hashes against the National Software Reference Library's Reference Data Set. It helps digital forensics investigators quickly identify known software files, reducing the volume of data that requires manual examination during investigations.
Digital forensics investigators, incident response teams, and security professionals who need to efficiently triage large collections of files during investigations.
Developers choose nsrllookup for its focused functionality, seamless integration with existing forensic tools, and ability to significantly reduce investigation time by filtering out known software files from evidence collections.
Overview
Checks with NSRL RDS servers looking for for hash matches
Use Cases
Best For
- Reducing false positives in digital forensics investigations
- Triage of large file collections during incident response
- Identifying known software files in evidence sets
- Integrating hash lookup into automated forensic pipelines
- Educational purposes in digital forensics training
- Quick filtering of commonplace files from suspicious ones
Not Ideal For
- Investigations requiring modern hash algorithms like SHA-256 or SHA-3
- Environments without network access or ability to host a local server
- Teams needing GUI-based tools or real-time interactive file analysis
- Projects where NSRL RDS coverage is insufficient for custom or niche software
Pros & Cons
Pros
Integrates cleanly with tools like md5deep to filter known files from large collections, as shown in the README example using pipelines.
Pre-configured to use the public nsrllookup.com server, reducing setup time for casual or low-volume users.
Supports setting up private local servers for high-volume lookups, ensuring scalability and control over data.
Does one thing well—hash lookup—making it easy to incorporate into existing forensic workflows without unnecessary complexity.
Cons
Building from source on Windows requires manual edits to CMakeLists.txt and careful Boost version matching, as admitted in the README.
Only handles MD5 hashes, which may be outdated for security contexts requiring stronger algorithms like SHA-256.
Relies on an external hash server; high-volume usage necessitates private server setup, adding operational and maintenance costs.
Frequently Asked Questions
Related Projects
Detect It Easy(DiE)Program for determining types of files for Windows, Linux and MacOS.
capaThe FLARE team's open-source tool to identify capabilities in executable files.
LOKILoki - Simple IOC and YARA Scanner
HashCheckHashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.