Forensic Hashing Tools

hashdeep

Hashdeep is a utility that can compute hashes for many files, looking recursively through directories and computing hashes for each file found. It also contains features to compare and audit message digests. By default, it computes the MD5 and SHA256 hash of the files, although other types can be specified. Available hash types are MD5, SHA1, SHA256, Tiger, and Whirlpool. The below example generates MD5 and SHA256 hashes (same as default no -c given) for files in the /root/Desktop/files/ directory.

Example usage: hashdeep -c md5,sha256 /root/Desktop/files/

md5deep

md5deep is a tool used to compute and compare MD5 message digests. The example below recursively creates MD5 message digests of files found in /root/Desktop/
Example usage: md5deep /root/Desktop/*

sha1deep

Like md5deep, sha1deep is used to computer and compare message digests. Sha1deep deals with SHA1 digests. The usage is the same as md5deep, and the below example creates SHA1 digests of files found in /root/Desktop/
Example usage: sha1deep /root/Desktop/*

sha256deep

Like md5deep, sha256deep is used to computer and compare message digests. Sha256deep deals with SHA256 digests. The usage is the same as md5deep, and the below example creates SHA256 digests of files found in /root/Desktop/

Example usage: sha256deep /root/Desktop/*

tigerdeep

Like md5deep,tigerdeep is used to computer and compare message digests. tigerdeep deals with tiger digests. The usage is the same as md5deep, and the below example creates tiger digests of files found in /root/Desktop/

Example usage: tigerdeep /root/Desktop/*

whirlpooldeep

Like md5deep, whirlpooldeep is used to computer and compare message digests. whirlpooldeep deals with whirlpool digests. The usage is the same as md5deep, and the below example creates whirlpool digests of files found in /root/Desktop/

Example usage: whirlpooldeep /root/Desktop/*