Digital Forensics Dispatch

National Institute of Standards and Technology (NIST) Updates Software Reference Library

June 30, 2022

On June 27, the National Institute of Standards and Technology (NIST) announced that an update to the National Software Reference Library (NSRL) has been issued. The NSRL is a list of hash values for common operating systems and other files. A hash value is like a digital fingerprint and each file has its own unique value.

The NSRL list helps examiners in both criminal and civil investigations. The list can be used to weed out files that are of little to no evidentiary value, allowing for the examiners to focus on the files not found on the list. Doug White, a NIST computer scientist states “Only some of the data on a phone or other device might be relevant to an investigation, though. The update should make it easier for police to separate the wheat from the chaff.”

The addition of more hash values to the list is not the only change that has been made. The updated list will be maintained in a SQLite format, whereas the previous versions were extremely large text files. NIST hopes that this format will make it easier on examiners to perform custom filtering and sorting of values. NIST writes “the SQLite format, which makes it easier for users to create custom filters to sort through files and find what they need for a particular investigation.”

As of August 2019, the NSRL had around half a billion hash records. In March of 2022 the list was comprised of over a billion hash values, and that number is anticipated to grow in the future.

The NSRL hash set list is something that our digital forensic examiners use from time to time, and the update to the list is certainly a good thing in their eyes. The NSRL list can be downloaded here.

Email:    Phone: 703.359.0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com/services/digital-forensic