From owner-freebsd-questions@FreeBSD.ORG Wed Jul 20 19:12:01 2011 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 26622106564A for ; Wed, 20 Jul 2011 19:12:01 +0000 (UTC) (envelope-from kraduk@gmail.com) Received: from mail-yi0-f54.google.com (mail-yi0-f54.google.com [209.85.218.54]) by mx1.freebsd.org (Postfix) with ESMTP id D0AE68FC14 for ; Wed, 20 Jul 2011 19:12:00 +0000 (UTC) Received: by yic13 with SMTP id 13so307514yic.13 for ; Wed, 20 Jul 2011 12:12:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=xkXRlI40I3TfHGLAIipp4e04PkHqnFoL62Z84iRWnQU=; b=RfYqsYQ1aBqsHHJz5TVzLYNKF5oujx89jnsw4IunzM9tZHh4aXZK5jnWNbzdX4n/q1 ivZWWsJFNMMdm6P+3VzafLSfsdUJ9hNPb4SwytEiNttycuxT0S73uXVdArXDqno0GsNB w4tjnsnot8uWagxon5YznvCTuG7Jry4AjVaeU= MIME-Version: 1.0 Received: by 10.236.170.7 with SMTP id o7mr12407364yhl.459.1311189120135; Wed, 20 Jul 2011 12:12:00 -0700 (PDT) Received: by 10.236.103.15 with HTTP; Wed, 20 Jul 2011 12:11:59 -0700 (PDT) In-Reply-To: References: <201107190549.p6J5n6sP028960@mail.r-bonomi.com> <4E252119.3030208@esiee.fr> <89EB5E14-AA8E-4265-9C5D-22641ECC1C37@my.gd> Date: Wed, 20 Jul 2011 20:11:59 +0100 Message-ID: From: krad To: Lars Eighner Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: Frank Bonnet , Damien Fleuriot , "C. P. Ghost" , "freebsd-questions@freebsd.org" Subject: Re: Tools to find "unlegal" files ( videos , music etc ) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jul 2011 19:12:01 -0000 > > >> > You cannot generate a hash without at a certain automated level opening the > file. If you can do that, couldn't you generate a hash of the first four > bytes to match with hashes of known magic numbers? If you can "look" at the > whole file, surely you can "look" at just the first four bytes. > > not true these days. If you run zfs (or probably btrfs, yuk) you can just pull the file hashes used by the fs (zdb). Therefore your not actually reading the file.