Bug#549292: ssdeep: No ouput for small files

Kingsley G. Morse Jr. change at nas.com
Fri Oct 2 07:39:15 UTC 2009

Package: ssdeep
Version: 2.2-1+b1
Severity: normal

Thanks for maintaining debian's ssdeep package.

I'm interested in using it on strings or small
files, and happened to notice that it produces no

Here's how to duplicate:

    $ echo -e "hello\nworld" > data1 
    $ cp data1 data2 
    $ echo 1 >> data2 
    $ ssdeep -b data1 > hash 
    $ ssdeep -bm hash data2

At least for me, the last line produces no output.

It occurs to me that ssdeep may only work on files
bigger than a certain size.

If this is so, then perhaps ssdeep's man page
should explain what the minimum size is.

Even better, enhance ssdeep to actually work with
small files or strings.


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.25-2-686 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash

Versions of packages ssdeep depends on:
ii  libc6                         2.9-6      GNU C Library: Shared libraries

ssdeep recommends no packages.

ssdeep suggests no packages.

-- no debconf information

More information about the forensics-devel mailing list