hashdeep

Compute MD5 and SHA-256 hashes of files recursively

$ hashdeep -r [path/to/directory]

$ hashdeep -c [sha256] [path/to/files]

$ hashdeep -r [path/to/directory] > [manifest.txt]

$ hashdeep -r -a -k [manifest.txt] [path/to/directory]

$ hashdeep -r -m -k [manifest.txt] [path/to/directory]

$ hashdeep -r -x -k [manifest.txt] [path/to/directory]

$ hashdeep -r -e [path/to/directory]

hashdeep [-c alg] [-k file] [-amxwMXrespblvv] [files]
hashdeep -c alg1,alg2 -r directory

hashdeep computes multiple cryptographic hashes simultaneously for files and directories. Unlike single-hash tools, it calculates MD5 and SHA-256 by default, providing stronger verification through multiple algorithms.
The tool excels at file integrity verification and digital forensics. It can create manifests of known-good files, then audit systems to detect changes, additions, or deletions. Audit mode reports file states: MATCH for identical files, MISMATCH for modified files, MISSING for deleted files, and NEW for added files.
Output follows the DFXML-compatible hashdeep format, including file size, hash values, and path. This format can be loaded with -k for later verification. The tool handles large directory trees efficiently with recursive scanning and optional threading.

-c ALG

Compute hashes using specified algorithms (md5, sha1, sha256, tiger, whirlpool); default is md5,sha256

Recursive mode; traverse all subdirectories

Load file of known hashes for comparison

Audit mode; compare files against known hashes

Positive matching; only show files that match known hashes

Negative matching; only show files NOT in known hashes

Like -m but also print hash of each matching file

Like -x but also print hash of each non-matching file

When auditing, display which known file matched

Display progress indicator and time estimate

Silent mode; suppress error messages

Bare mode; strip directory paths from output

Use relative file paths instead of absolute

Piecewise mode; break files into chunks before hashing

Verbose mode; use multiple times for more detail

Use specified number of threads

Output in DFXML format

Show help message

Show version

Hash algorithms like MD5 and SHA-1 have known collision vulnerabilities and should not be relied upon for security-critical verification. Use SHA-256 or stronger algorithms when integrity is paramount. Very large files may take considerable time to hash. The tool reads files sequentially and may be I/O bound.

hashdeep was written by Jesse Kornblum and Simson Garfinkel as part of the md5deep package of forensic hashing tools. First released in 2003, it was designed for digital forensics investigators who needed to verify file integrity and detect tampering. The multi-hash capability was added to address weaknesses in individual algorithms. The project is commonly used in law enforcement digital forensics and enterprise data integrity verification.

md5sum(1), sha256sum(1), sha1deep(1), md5deep(1)