1 2SSDEEP FILE FORMAT VERSION 1.1 3 41. REVISION HISTORY 5 614 Aug 2006 - Initial version (jk) 715 Jul 2010 - Adding quotation marks to filenames 8 9 10 112. FILE HEADER 12 13The first line of the file is a header, like this: 14 15ssdeep,1.1--blocksize:hash:hash,filename 16 17ssdeep - Identifies the file type 181.1 - The version of the file format, NOT the version of the program 19-- - Separator 20 21The remainder of the line identifies the format of the file. 22Note that for version 1.1 these values must be given EXACTLY as shown above 23 24 253. FILE DATA 26 27Each line represents the hash of one file as listed in the header. 28Specifically, we have the blocksize used by the program, the hash 29for this blocksize and twice the blocksize, and the filename. Filenames 30are enclosed in quotation marks. Filenames which contain a quotation mark 31will have those quotes slash escaped. For example, the file ma"in.c 32will be listed as: 33 34"ma\"in.c" 35 36 37