The National Software Reference Library (NSRL), is a project of the
National Institute of Standards and Technology
The National Institute of Standards and Technology (NIST) is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. NIST's activities are organized into physical s ...
(NIST) which maintains a repository of known software, file profiles and file signatures for use by law enforcement and other organizations involved with computer forensic investigations. The project is supported by the
United States Department of Justice
The United States Department of Justice (DOJ), also known as the Justice Department, is a federal executive department of the United States government tasked with the enforcement of federal law and administration of justice in the United Stat ...
's
National Institute of Justice, the
Federal Bureau of Investigation
The Federal Bureau of Investigation (FBI) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. Operating under the jurisdiction of the United States Department of Justice, ...
(FBI),
Defense Computer Forensics Laboratory
The Department of Defense Cyber Crime Center (DC3) is designated as a Federal Cyber Center by National Security Presidential Directive 54/Homeland Security Presidential Directive 23, as a Department of Defense (DoD) Center Of Excellence for Digit ...
(DCFL), the
U.S. Customs Service, software vendors, and state and local law enforcement.
It also provides a research environment for computational analysis of large sets of files.
Components
The NSRL is made up of three major elements:
# A large physical collection of commercial software packages (e.g.,
operating systems, off-the-shelf application software);
# A database containing detailed information, or
metadata, about each file that makes up each of those software packages;
# A smaller public dataset containing the most widely used metadata for each file in the collection that is published and updated quarterly. This is called the ''Reference Data Set''.
Reference Data Set
The NSRL collects
software
Software is a set of computer programs and associated software documentation, documentation and data (computing), data. This is in contrast to Computer hardware, hardware, from which the system is built and which actually performs the work.
...
from various sources and computes
message digest
A cryptographic hash function (CHF) is a hash algorithm (a map of an arbitrary binary string to a binary string with fixed size of n bits) that has special properties desirable for cryptography:
* the probability of a particular n-bit output ...
s, or cryptographic hash values, from them. The digests are stored in the Reference Data Set (RDS) which can be used to identify "known" files on digital media. This will help alleviate much of the effort involved in determining which files are important as
evidence on computers or file systems that have been seized as part of criminal investigations.
Although the RDS hashset contains some malicious software (such as
steganography
Steganography ( ) is the practice of representing information within another message or physical object, in such a manner that the presence of the information is not evident to human inspection. In computing/electronic contexts, a computer file, ...
and
hacking tools) it does not contain illicit material (e.g. indecent images).
The collection of original software media is maintained in order to provide repeatability of the calculated hash values, ensuring admissibility of this data in
court
A court is any person or institution, often as a government institution, with the authority to adjudicate legal disputes between parties and carry out the administration of justice in civil, criminal, and administrative matters in acco ...
.
In 2004 the NSRL released a set of hashes for verifying
eVoting software, as part of the US
Election Assistance Commission's Electronic Voting Security Strategy.
As of October 1, 2013 the Reference Data Set is at version 2.42 and contains over 33.9 million unique hash values. The
data set A data set (or dataset) is a collection of data. In the case of tabular data, a data set corresponds to one or more database tables, where every column of a table represents a particular variable, and each row corresponds to a given record of the ...
is available at no cost to the public.
In addition to operating system and application software, the library has also collected numerous popular video game titles to be used both as part of data forensics, as well as partially to serve as
video game preservation
Video game preservation is a form of preservation applied to the video game industry that includes, but is not limited to, digital preservation. Such preservation efforts include archiving development source code and art assets, digital copies o ...
.
See also
*
Digital forensics
Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery, investigation, examination and analysis of material found in digital devices, often in relation to mobile devices and comp ...
References
External links
*
{{Digital forensics
United States Department of Commerce
National Institute of Standards and Technology
Digital forensics organizations