Autopsy 3 module for Approximate Hash Based Matching (AHBM) using sdhash
- Download sdhash 3.3 pre-built binary for Windows from http://sdhash.org
- Unzip and place the files in a conveniant directory
- Update the environment variable "Path" to point to the directory containing sdhash.exe
- Open cmd and verify that running "sdhash" prints out the usage for the tool
- Start Autopsy 3, Go to Tools -> Plugins -> Downloaded plugin > Add
- Follow the instructions there
- Restart Autopsy