From 5686c8192b3962862f39d52cdae751de5c2314f1 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Thu, 7 Sep 2017 19:38:39 -0400 Subject: [PATCH] Update DeepWhite.md --- DeepWhite.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DeepWhite.md b/DeepWhite.md index 6db8acc..16185b1 100644 --- a/DeepWhite.md +++ b/DeepWhite.md @@ -31,7 +31,7 @@ C:\> hashdeep.exe -r / -c md5,sha1,sha56 > raw-hashes.csv ``` Note that hashdeep, etc., has a dumb recursive design (from the manpage): -> Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot be used to examine all files of a given file extension. For example, calling hashdeep -r *.txt will examine all files in directories that end in .txt. Move file to Unix/Linux, remove Windows carriage returns, grab EXEs and DLLs, make CSV. +> Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot be used to examine all files of a given file extension. For example, calling hashdeep -r *.txt will examine all files in directories that end in .txt. On Linux/Unix: create a new CSV with the proper header (required by PowerShell's ConvertFrom-Csv), take the raw CSV, remove the carriage returns, select DLLs, EXEs and SYS files, grab the 2nd field to the end, and append to the new CSV: ```shell