Simple forensics with PowerShell

After installing the Community Extensions, you can easily hash files (MD5) with PowerShell:

Get-Hash file.txt

You can use this for simple forensic purposes. For example, make a text file (aka 'hash database'), containing the hash values of all files in a specific folder:

Get-Hash c:\myfirstfolder\*.* | Format-Table -property hashstring > file1.txt

You can use this newly created hash database to find matches with files in a different folder (or on a different computer). Create a hash database of the files in the other folder:

Get-Hash c:\mysecondfolder\*.jpg | Format-Table -property hashstring > file2.txt

Now, you can use PowerShell to find the matches:

Compare-Object -referenceobject $(get-content c:\myfirstfolder\file1.txt) -differenceobject $(get-content c:\mysecondfolder\file2.txt) -includeequal | where-object {$_.SideIndicator -match "=="}

This is just a very simple example, but it works and it's nice to play with :-)