Which of These Files Has Anybody Seen Before SIEVE
Most files on any machine are the operating system and are identical everywhere. Take those off the table and what is left is where the hours should go.
The files
A folder, or a selection of files. They are hashed in this tab with MD5, SHA-1 and SHA-256 at once, because a list you are handed later may be in any of the three and rehashing the whole machine is an afternoon nobody has.
The lists
Any text or CSV with hashes in it: one per line, the output of sha256sum, an NSRL-style export, or a spreadsheet column. Every token on every line that looks like a hash is taken, and whatever is left of the line becomes the label.
What is left to look at
File by file
Two findings that need no list
The record
Questions people ask about SIEVE