A Comparison of Fuzzy Hashes: Evaluation, Guidelines, and Future Suggestions

Abstract

Fuzzy hashes are gaining recognition in the realm of digital forensics as an alternative method of recognizing similar or nearly identical files. However, despite a high diversity of algorithms in existence, only SSDEEP and sdhash are widely used. This paper describes several viable fuzzy hashes not in wide use and compares them in detail, examining both security and non-security flaws. Finally, we develop guidelines to put these hashes to practical use, as well as suggesting improvements to several of the hashes.