hashdeep
Recursively compute hashsums or piecewise hashings for MD5, SHA1, SHA256, tiger, and whirlpool algorithms. Useful for comparing hashes against known lists in forensics investigations.
Description
hashdeep is a set of tools to compute hashsums of arbitrary number of files recursively. It supports MD5, SHA1, SHA256, tiger, and whirlpool algorithms, with features like comparing computed hashes against a list of known hashes, displaying matches or non-matches, estimating processing time for large files, and piecewise hashing in arbitrary sized blocks.
The package includes hashdeep for multi-algorithm support and specialized tools like md5deep, sha1deep, sha256deep, tigerdeep, and whirlpooldeep. It is particularly useful in forensics investigations for auditing file integrity and identifying known or altered files.
Key modes include audit mode to validate files against known hashes, matching mode to find files that match a known hash list, and negative matching to identify files that do not match.
How It Works
hashdeep recursively traverses directories and computes message digests using specified algorithms like MD5, SHA1, SHA256, tiger, or whirlpool. In piecewise mode, files are divided into blocks of specified size for hashing. It compares computed hashes against a known hash file provided via -k, supporting audit (-a), matching (-m), and negative matching (-x) modes. Output can be in DFXML format, with options for threading, verbosity, and filtering by file size or type.
Installation
sudo apt install hashdeepFlags
Examples
hashdeep -hhashdeep -c md5,sha256 -r /path/to/fileshashdeep -a -k known_hashes.txt /path/to/fileshashdeep -m -k known_hashes.txt /path/to/fileshashdeep -x -k known_hashes.txt /path/to/fileshashdeep -p 1024 -r /path/to/filesmd5deep -hmd5deep -m known_hashes.txt /path/to/files