Creating NSRL Hashset

The National Software Reference Library is a project from the National Institute of Standards and Technology. It consists of several file downloads of CSV files containing hashes of file contents. You can use this library to determine the source of a hash (which software package it came from) or, in the case of Truxton, eliminate files that will have no evidence in them.

How to Create NSRL Hash Set

Follow these steps:

1. Download the data from NIST
2. Unzip or mount the ISO and unzip the NSRLFile.txt
3. Run the Truxton\Tools\NSRLMinimalMD5.exe program to create a hash set file

   "C:\Program Files\Truxton\Tools\NSRLMinimalMD5.exe" NSRLFile.txt
   

4. Rename the output file

   ren Out.hashset 1.hashset
   

5. Repeat the above steps until you have produced all of the hash set files from the NSRL downloads.
6. Merge the hashset files into a single hashset file

   "C:\Program Files\Truxton\Loader\Load.exe" -mergehashsets Yes 1.hashset 2.hashset 3.hashset 4.hashset 5.hashset 6.hashset
   

7. Rename the merged hashset into what you want

   ren merged.hashset LatestNSRL.hashset
   

8. Replace the existing hash set file for the ETL layer with this new one.