"""
A much faster solution would be the same approach rsync takes with its "rolling checksum."
"""
I know this function is attributed to Bernstein and it's called Bernstein hash [0]. You're describing the Rabin-Karp string matching algorithm [1].
[0] http://fr.wikipedia.org/wiki/Table_de_hachage#Fonction_de_Ha...
[1] http://en.wikipedia.org/wiki/Rabin-Karp_string_search_algori...
Absolutely. The right way to do it is to use the memmem library call.
A much faster solution would be the same approach rsync takes with its "rolling checksum."
That's one way to improve performance, yes. (But it far predates rsync -- I think it might even predate Tridge.)
In many cases, a "look and skip" algorithm like KMP or BM will outperform a rolling checksum search; but of course if you've got 328MB of data on disk, nothing will make the search faster than the time it takes to read the data into RAM.