1
2SSDEEP FILE FORMAT VERSION 1.1
3
41. REVISION HISTORY
5
614 Aug 2006 - Initial version (jk)
715 Jul 2010 - Adding quotation marks to filenames
8
9
10
112. FILE HEADER
12
13The first line of the file is a header, like this:
14
15ssdeep,1.1--blocksize:hash:hash,filename
16
17ssdeep - Identifies the file type
181.1    - The version of the file format, NOT the version of the program
19--     - Separator
20
21The remainder of the line identifies the format of the file.
22Note that for version 1.1 these values must be given EXACTLY as shown above
23
24
253. FILE DATA
26
27Each line represents the hash of one file as listed in the header.
28Specifically, we have the blocksize used by the program, the hash
29for this blocksize and twice the blocksize, and the filename. Filenames
30are enclosed in quotation marks. Filenames which contain a quotation mark
31will have those quotes slash escaped. For example, the file ma"in.c
32will be listed as:
33
34"ma\"in.c"
35
36
37