Comparing hash values

[m00nbl00d]

I'm wondering if anyone is familiar with an application that calculates hash values, and that allows to compare the results against a list of hash values (say a text file that could be imported to the application), and if it finds any match, to log it?

[MrBrian]

OSForensics has a hash set feature.

[m00nbl00d]

-{ Quote: "OSForensics has a hash set feature." }-

Thanks. I'll check it out. :)

[MrBrian]

-{ Quote: "Thanks. I'll check it out. :)" }-

You're welcome :).

ProDiscover apparently has this feature (http://www.techpathways.com/webhelp/Comparing_Hashkeeper_hash_sets.htm), but I'm not sure if the free version does.

[m00nbl00d]

-{ Quote: "You're welcome :).

ProDiscover apparently has this feature (http://www.techpathways.com/webhelp/Comparing_Hashkeeper_hash_sets.htm), but I'm not sure if the free version does." }-

Thanks. I also came across Access Data Forensic Toolkit (-http://accessdata.com/products/forensic-investigation/ftk)

Not a simple application, though. ;D -http://accessdata.com/ftk32

But, worth checking it out in a near future... when I get the chance.

[sfi]

Md5deep is also something you may want to look at. It offers a command line interface to creating and comparing hashes. It also supports a few other hashes like SHA1, SHA256 and whirlpool as well.

[m00nbl00d]

-{ Quote: "Md5deep is also something you may want to look at. It offers a command line interface to creating and comparing hashes. It also supports a few other hashes like SHA1, SHA256 and whirlpool as well." }-

Thanks. :)

[Dermot7]

http://support.microsoft.com/kb/841290

Maybe this might help?

[m00nbl00d]

-{ Quote: "http://support.microsoft.com/kb/841290

Maybe this might help?" }-

It might be useful. I was familiar with it, but never really explored all its functionality.

Thanks for bringing it up! :thumb:

[m00nbl00d]

Due to some other stuff, I've been unable to keep this subject, but it turns out that Microsoft's tool only allows to verify MD5 and SHA1. It's OK if you don't want to verify SHA256, for example.

I'm going to look at those other alternatives, and proceed with the research and see if I find more tools (just for the kicks lol), and I'll share if I find any other tool.

[ronjor]

http://www.karenware.com/powertools/pthasher.asp

[J_L]

HashTab ftw.

[m00nbl00d]

Thank you both for sharing those two applications. :thumb:

[m00nbl00d]

By the way, it was mentioned md5deep. For those interested, it's an open source application and you can get it here -http://md5deep.sourceforge.net/

At the same website, you can also read about hashdeep. -http://md5deep.sourceforge.net/hashdeep.html

[HAN]

I use Nirsoft's HashMyFiles http://www.nirsoft.net/utils/hash_my_files.html It does the basics very well (calculate and display hash comparisons) and more than that too (which I don't make use of.) It is portable if need be but can also be installed and then incorporated into the context menu (which is what I do.) Highly recommended!

[m00nbl00d]

-{ Quote: "I use Nirsoft's HashMyFiles http://www.nirsoft.net/utils/hash_my_files.html It does the basics very well (calculate and display hash comparisons) and more than that too (which I don't make use of.) It is portable if need be but can also be installed and then incorporated into the context menu (which is what I do.) Highly recommended!" }-

I totally forgot to verify if Nirsoft's website had any hash verification tool. :-[


Thank you! :thumb:

[Pedro]

Pandlouk recommended some open source application, but i don't recall the name.
I would search for that on this forum, as he usually has good advice.

[m00nbl00d]

-{ Quote: "Pandlouk recommended some open source application, but i don't recall the name.
I would search for that on this forum, as he usually has good advice." }-

Will do! Thank you. :thumb:

I've found one open source application mentioned by user Pandlouk, FileVerifier++. -http://www.programmingunlimited.net/siteexec/content.cgi?page=fv

I'll look and see if more were mentioned. This one does seem to be very interesting, judging by its features.

[m00nbl00d]

I found this one (http://www.novirusthanks.org/product/md5-checksum-tool/) by NoVirusThanks.org.

Unfortunately, it only checks for MD5. I might send an e-mail to them, so that they also add SHA1 and SHA256... if not more.

[m00nbl00d]

I came across Cobynsoft’s Hash Calculator.

It allows to verify files and folders (MD5, SHA-1, SHA-256 and SHA-512). You can export results to XLS, XLSX and PDF.

Apparently, it cannot compare previously computed hashes. I may send some feedback to the developers asking if they could support it. ;D

It's free.

-http://www.cobynsoft.com/products/freeware/cobynsofts-hash-calculator/

Screenshot: -http://www.cobynsoft.com/wp-content/uploads/2011/06/Cobynsofts_Hash_Calc_1_1_Screenshot.png

[MrBrian]

I use FileVerifier++ (already mentioned) for periodically auditing my documents - if anything has changed (by hash), been deleted, or added. If anyone's interested, I can tell you how to do that.

[Ranget]

-{ Quote: "I found this one by NoVirusThanks.org.

Unfortunately, it only checks for MD5. I might send an e-mail to them, so that they also add SHA1 and SHA256... if not more.
Reply With Quote" }-

+1 Need to add sha1 to the program

if you need there are also programs from Nirsoft

[TheKid7]

I use HashCalc.

http://www.slavasoft.com/hashcalc/

[m00nbl00d]

-{ Quote: "+1 Need to add sha1 to the program
" }-

They already added them. I sent a PM to novirusthanks at this forum, sometime ago, and the newest version already supports it. :thumb:

-{ Quote: "
if you need there are also programs from Nirsoft" }-

Yes, there are great tools over there... For some unknown reason, I never remember of Nirsoft. ;D :wacko: I got AppCrashView and BlueScreenView on my flash drive, though. :D

[Ranget]

Gr8 to hear that they added that :D

Nirsoft Programs are awesome Really Lot of other programs Depend on their tools ;)

[m00nbl00d]

There's also MultiHasher, by the same team that develops HostsMan.

I ran it for a brief moments and seems good. It also has command line parameters, but I haven't tried those yet. You can also query Virus Total and upload files to it.

-http://www.abelhadigital.com/multihasher

-{ Quote: "
Calculate one or more hash values for a single file at once
Calculate hash values for multiple files and text string
Supported hash algorithms: CRC32, MD5, SHA-1, SHA-256, SHA-384, SHA-512
Supports hash file verification (MHX, SFV, MD5Sum, etc.)
Supports NT file namespace
Able to query VirusTotal database
Able to upload files to VirusTotal (API key required)
Integrates with Windows Explorer context menu (optional)
Hash calculation can be canceled
Unicode support
Supports file drag'n'drop
Localizable UI
Portable
...
" }-

[m00nbl00d]

I found another one. It's an open source project (For those who enjoy open source... and who knows, would like to contribute to it.).

Hash Codes -http://sourceforge.net/projects/hashcodes/

-{ Quote: "
Hash data from keyboard, file or CD/DVD
Uses Adler32, CRC32, CRC64, GOST, HAVAL, MD2, MD4, MD5, MD6, SHA-0, SHA-1, SHA-1-IME, SHA-224, SHA-256, SHA-384, SHA-512, RIPEMD-128, RIPEMD-160, RIPEMD-256, RIPEMD-320, TIGER and Whirlpool algorithm
Copy hash codes to the clipboard or save to the disk
Can compare hash codes
Load saved hash code file to comparison
The progress bar show the current process
Suspend, resume or stop the hash process
Save the log information
Display the hashing time
Version on 32-bit and 64-bit Windows system
Can be used as standalone software
Multilingual user interface (Chinese (Simplified), Chinese (Traditional), English, German, Italian, Polish, Slovenian, Spanish)
Drag & Drop support
" }-

Sounds interesting. It could feature a command line utility, though. I think I got this one in a pile of software to try. I'm addicted to trying software. :wacko:

[BrandiCandi]

-{ Quote: " I'm addicted to trying software. :wacko:" }-
And I'll enable your addiction as much as I can- this thread is great information! Can I ask what's driving your search?

[m00nbl00d]

-{ Quote: "And I'll enable your addiction as much as I can- this thread is great information! Can I ask what's driving your search?" }-

Well, initially I was simply looking for a hash computing software that would allow me to save and/or load previously computed hashes for later comparison. This is a nice way of being sure, say, your Downloads folder content is as it should be.

Then, I simply kept looking for more alternatives (No, I got no urges... lol I search once in awhile ;D ); we never know what's out there. Recently, I found, at least, two utilities that allow drag & drop. Really nice functionality, for those moments where we want to check the hash value of a file really fast.

I also got at least one PowerShell script, that will also compute hash values. I downloaded it sometime ago, but never tried it. I'll have to try; I also don't recall the website where I got it from, but I think it was hosted at a scripts repository belonging to Microsoft.

The web is full of good stuff. Every time I make a new search, I always find something I haven't before. :D