wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About

© 2026 winget.ragerworks.com

Loading...
Install blazehash using Winget - wingetCollections
  1. Go back
  2. Packages
  3. blazehash
blazehash logo

blazehash SecurityRonin

blake3 cli dfir forensics hash hashdeep mcp sha256
Use this command to install blazehash:
winget install --id=SecurityRonin.blazehash -e

Blazehash is a high-performance forensic-grade file hashing tool designed to provide cryptographic integrity verification and chain-of-custody metadata for digital evidence. It supports multiple algorithms including BLAKE3, SHA-256, SHA-512, SHA-3, MD5, WHIRLPOOL, SSDEEP, and TLSH, making it versatile for various forensic and auditing workflows.

Key Features:

  • Multi-algorithm support: Simultaneously compute hashes using multiple algorithms for comprehensive verification.
  • Manifest format compatibility: Works with hashdeep manifest files for seamless integration into existing audit workflows.
  • MCP server functionality: Enables AI-native forensic pipelines by providing a machine communication protocol (MCP) interface.
  • Audit mode and chain-of-custody tracking: Records case metadata, examiner details, and timestamps to establish provenance and integrity of evidence.
  • Remote storage compatibility: Directly hash files from cloud storage (S3, GCS, Azure Blob, etc.) and write manifests to remote URIs without additional setup.

Audience & Benefit: Ideal for forensic investigators, cybersecurity professionals, and digital取证 experts who require robust tools to process and verify digital evidence. Blazehash provides a single, court-ready solution that ensures cryptographic integrity, establishes chain of custody, and integrates seamlessly with modern cloud workflows. Its performance and compatibility make it a reliable choice for both on-premises and remote forensic operations.

Blazehash can be installed via winget for Windows users, ensuring easy deployment in professional environments.

README

Crates.io License: MIT CI Release Sponsor

Hash. Sign. Timestamp. Prove. Seal.

You're already using hashdeep. blazehash is what it looks like with everything you've been asking for: BLAKE3 at 1,640 MB/s, 25 hash algorithms, Ed25519 + post-quantum signing, Bitcoin-anchored timestamps, YARA scanning, and native cloud storage — while every hashdeep flag and output format works exactly as before.

brew tap SecurityRonin/tap && brew install blazehash

Full documentation →

Install

macOS

brew tap SecurityRonin/tap && brew install blazehash

Debian / Ubuntu / Kali

curl -1sLf 'https://dl.cloudsmith.io/public/securityronin/blazehash/setup.deb.sh' | sudo bash
sudo apt install blazehash

Windows

winget install SecurityRonin.blazehash

Cargo

cargo install blazehash

Three Things You Do With This

Acquire evidence — court-ready in one pipeline

blazehash -r /mnt/evidence -c blake3,sha256 \
  --case "CASE-2026-001" --examiner "Jane Smith" \
  -o evidence.hash --progress
blazehash sign evidence.hash        # Ed25519 signature
blazehash seal evidence.hash        # Merkle tamper-evidence seal
blazehash ots stamp evidence.hash   # Bitcoin blockchain timestamp (requires --features ots)
blazehash report evidence.hash -o report.html

One manifest proves (cryptographic hashes), (Ed25519 signature), (Bitcoin blockchain anchor), (Merkle root commits every file), and (case/examiner metadata).

Versions
0.2.4
0.2.2
0.2.1
0.2.0
Website
github.com
License
Last updated
4/12/2026
Download latest version
what
who
when
structure
context

Acquisition guide →

Verify integrity — weeks or months later

blazehash -r /mnt/evidence -a -k evidence.hash
blazehash verify-sig evidence.hash       # Ed25519 signature check
blazehash verify-proof evidence.hash     # Merkle inclusion proof check
blazehash ots verify evidence.hash       # Bitcoin timestamp check

Hunt threats

blazehash -r /mnt/suspect -c sha256 \
  --nsrl NSRL.db --nsrl-exclude \
  --hashdb-bad malware.txt \
  --yara rules.yar --yara-max-size 512 --entropy

--yara-max-size sets the per-file size limit for YARA scanning (default: 256 MB). Files above the threshold are stream-hashed normally but YARA is skipped with a warning.

Threat hunting guide →

What's New vs hashdeep

Every hashdeep flag works. Your existing scripts keep working. These are the additions:

blazehashhashdeep
BLAKE3 (1,640 MB/s)Y—
25 hash algorithms (Blake3/SHA/MD5/fuzzy/checksums)Y7
Ed25519 manifest signingY—
Post-quantum signing (CRYSTALS-Dilithium)Y—
N-of-M cosigningY—
Bitcoin timestamps (OpenTimestamps)Y—
Merkle tamper-evidence seals + inclusion proofsY—
Case/examiner metadataY—
HTML chain-of-custody reportY—
NSRL known-good filteringY—
YARA rule scanning + ATT&CK tag lookupY—
VirusTotal batch lookupY—
Shannon entropyY—
Fuzzy / similarity hashing (ssdeep + TLSH)Y—
Duplicate detectionY—
Manifest diff / merge / updateY—
Live monitoring (watch)Y—
Remote storage (S3/GCS/Azure/WebDAV/60+ protocols)Y—
Google Drive hash-without-downloadY—
GPU-accelerated SHA-256/MD5Y—
MCP server (AI-assisted workflows)Y—
EWF / E01 image verificationY—
SQLite / Parquet / DuckDB outputY—
STIX 2.1 / ECS NDJSON outputY—

Performance

Apple M4 Pro, macOS 15.7.5, warm cache. Full methodology: docs/benchmarks.md.

WorkloadblazehashhashdeepSpeedup
1 GiB, SHA-2562,182 ms2,485 ms1.14x
1 GiB, MD51,447 ms2,135 ms1.48x
1 GiB, SHA-1879 ms1,803 ms2.05x
1 GiB, BLAKE3655 msn/a—

BLAKE3 runs at 1,640–1,780 MB/s — 2.8x faster than hashdeep's best algorithm.

Remote Storage

Evidence doesn't live only on disk. blazehash speaks 50+ storage protocols natively — the same command works whether the data is local, on S3, in Google Drive, or on an SFTP server.

# Hash an S3 prefix directly
blazehash s3://dfir-bucket/case-001/

# Hash locally, write the signed manifest to S3 in one step
blazehash -r /mnt/evidence -c blake3,sha256 -o s3://dfir-bucket/case-001.hash
blazehash sign s3://dfir-bucket/case-001.hash

# Audit weeks later — manifest stays in the cloud
blazehash -a -k s3://dfir-bucket/case-001.hash -r /mnt/evidence

# Hash a Google Drive file without downloading it
blazehash gdrive://1ABCdef...
blazehash https://drive.google.com/file/d/1ABCdef.../view

# Hash over SFTP — no staging, no temp files
blazehash sftp://admin@192.168.1.10/cases/image.dd

Credentials come from standard environment variables — AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS, AZURE_STORAGE_ACCOUNT — so existing tooling and CI secrets work without changes. For Google Drive, run blazehash gdrive auth login once.

Supported: S3, GCS, Azure Blob/Files/ADLS, Backblaze B2, Tencent COS, Huawei OBS, Alibaba OSS, OpenStack Swift, OneDrive, Dropbox, Google Drive, pCloud, Yandex Disk, SFTP, FTP, WebDAV, WebHDFS, Redis, MongoDB, PostgreSQL, and 30+ more →

Optional Feature Flags

Distributed packages (brew/apt/winget) include all features. For cargo install, use --all-features to get everything:

cargo install blazehash --all-features
FlagDefaultEnables
remoteonRemote storage (S3/GCS/Azure/SFTP/GDrive/60+ protocols)
sqliteon--format sqlite output + NSRL SQLite database
parquet-outputon--format parquet output
duckdb-outputon--format duckdb output
archiveonZIP/TAR archive hashing
qronblazehash qr QR code generation
pqonblazehash pq-sign / pq-verify-sig post-quantum signing
forensic-imageon--verify-image EWF/E01 forensic image verification
gpuonGPU-accelerated SHA-256/MD5
yaraoff--yara YARA rule scanning with ATT&CK tag lookup
reportoffblazehash report HTML chain-of-custody generation
dockeroffblazehash image OCI/Docker layer hashing
otsoffblazehash ots stamp / ots verify Bitcoin timestamps
tuioffblazehash tui interactive dashboard
hashdboff--hashdb-bad known-bad file flagging (requires sqlite)

Acknowledgements

Jesse Kornbluth created hashdeep and gave it to the forensic community as a public domain tool.

Simson Garfinkel co-authored hashdeep and created DFXML, the Digital Forensics XML standard.

The BLAKE3 team — Jack O'Connor, Samuel Neves, Jean-Philippe Aumasson, and Zooko Wilcox-O'Hearn.

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd