System and method for identifying files based on hash values

A computer system for forensically investigating a target dataset including a target file by comparing the target file to a source file, the computer system including a processor and a memory in communication with the processor, the memory storing computer-executable instructions which when executed by the processor cause the computer system to:

• perform a file size matching operation to determine if a file size match between the target file and the source file exists, including:
• determining a file size of the target file (“target file size”);
• comparing the target file size to a file size of the source file (“source file size”);
• and
• where the target file size matches the source file size, identifying the file size match between the target file and the source file;
• and
• upon identifying a file size match, determine whether the target file size meets a predetermined file size threshold stored in a computer readable storage medium, the predetermined file size threshold for determining whether to perform a sub-hash matching operation or skip the sub-hash matching operation and proceed directly to a full hash matching operation;
• if the target file size meets the predetermined file size threshold, performing the sub-hash matching operation to determine if a sub-hash match between the target file and the source file exists, including:
• generating a sub-hash value of the target file (“target file sub-hash value”) comprising a first number of characters for comparing to a sub-hash value of the source file (“source file sub-hash value”), wherein the target file sub-hash value and the source file sub-hash value each represent a hashing of a predetermined subset of data in the target file and the source file, respectively, with a first hash function;
• comparing only a portion of the target file sub-hash value to a same portion of the source file sub-hash value, the portion being smaller than the target file sub-hash value and the source file sub-hash value, wherein the predetermined subsets of the target file and the source file are subsets of the same size and from the same location of the target file and source file, respectively, and the portion of the target file sub-hash value and source file sub-hash value are portions of the same size and from the same location of the predetermined subsets of the target file and source file, respectively;
• and
• where the portion of the target file sub-hash value matches the same portion of the source file sub-hash value, identifying the sub-hash match between the target file and the source file;
• and
• if the sub-hatch match is identified or the target file size does not meet the predetermined file size threshold, perform a full hash matching operation to determine if a full hash match between the target file and the source file exists, wherein performing the full hash matching operation includes:
• generating a full hash value of the target file (“target file full hash value”);
• and
• comparing the target file full hash value to a full hash value of the source file (“source file full hash value”);
• wherein the target file full hash value and the source file full hash value each represent a hashing of the entire data in the target file and the source file, respectively, with the same hash function.