FILE PRESENCE DETECTION AND MONITORING

摘要

There is described a module for detecting an electronic file, the module embodied on a computer readable medium and configured for: receiving a portion of a file and extracting content from the portion; applying an initial hashing function numerous times to the content, the initial hashing function being applied to each one of a plurality of blocks of elements within the content and resulting in a representation for each one of the blocks; selecting one of the representations from multiple representations as an initial imprint for the file portion; comparing the initial imprint to contents of a first memory containing a plurality of detection imprints for known electronic files to be detected, the detection imprints having been created using at least the initial hashing function; and determining a match when the initial imprint corresponds to a detection imprint in the first memory.