hashdeep
A cross-platform toolset for computing and auditing file hashes with multiple algorithms including MD5, SHA-1, SHA-256, Tiger, and Whirlpool.
What is hashdeep?
Hashdeep is a command-line utility for computing cryptographic hash values of files and directories using multiple algorithms like MD5, SHA-1, and SHA-256. It solves the need for file integrity verification, duplicate file detection, and forensic analysis by generating and comparing hash digests. The tool can recursively process directory structures and audit files against known hash sets.
System administrators, forensic analysts, and developers who need to verify file integrity, detect duplicates, or maintain checksums for large sets of files across different operating systems.
Developers choose Hashdeep for its multi-algorithm support, cross-platform compatibility, and built-in audit functionality, which together provide a reliable, scriptable solution for file integrity monitoring without requiring external dependencies.
Overview
Hashdeep (formerly md5deep) is a suite of command-line tools for computing cryptographic hashes of files and directories, with support for recursive directory traversal. It enables file integrity verification, duplicate detection, and forensic analysis by comparing computed hashes against known values.
Key Features
- Multi-Algorithm Support — Computes hashes using MD5, SHA-1, SHA-256, Tiger, and Whirlpool algorithms.
- Recursive Directory Traversal — Processes entire directory structures with a single command.
- Audit Mode — Compares file hashes against a known set to verify integrity, identifying missing, new, or modified files.
- Cross-Platform Compatibility — Works on Windows and POSIX systems with Unicode filename handling.
- Flexible Output — Generates hash lists that can be saved and reused for subsequent audits.
Philosophy
Hashdeep prioritizes reliability and forensic accuracy, providing a straightforward, scriptable toolset for file integrity monitoring and verification tasks.
Use Cases
Best For
- Verifying file integrity after transfers or backups
- Detecting duplicate files in large directories
- Forensic analysis and evidence collection
- Auditing system files against known good hashes
- Generating hash lists for software distribution verification
- Monitoring directory contents for unauthorized changes
Not Ideal For
- Projects requiring real-time, continuous file monitoring without manual intervention
- Environments needing modern cryptographic algorithms like SHA-3 or Blake2 for updated security standards
- Users who prefer graphical interfaces or simple package manager installations over command-line tools
Pros & Cons
Pros
Supports MD5, SHA-1, SHA-256, Tiger, and Whirlpool hashes, allowing choice based on security or compatibility needs, as listed in the README's feature overview.
Enables file integrity verification by comparing computed hashes against known sets to identify missing, new, or modified files, detailed in the README's audit mode explanation.
Works on both Windows and POSIX systems with a command-line interface, making it easy to integrate into automated scripts, as noted in the description.
Handles entire directory structures recursively with single commands, efficient for bulk hashing operations, mentioned in the README's functionality description.
Cons
Requires building from source using autoconf, automake, and make, which is more complex than binary package installs, as shown in the INSTALL instructions.
Audit files must have ASCII names on Windows despite supporting Unicode filenames for hashing, limiting flexibility in mixed environments, per the README's Unicode issues section.
Lacks newer hash algorithms like SHA-3, which may be needed for modern security applications, as the README only lists MD5, SHA-1, SHA-256, Tiger, and Whirlpool.
Frequently Asked Questions
Related Projects
Detect It Easy(DiE)Program for determining types of files for Windows, Linux and MacOS.
capaThe FLARE team's open-source tool to identify capabilities in executable files.
LOKILoki - Simple IOC and YARA Scanner
HashCheckHashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.