Verifying a File Hash

AP Cybersecurity · Securing Applications and Data

Verifying a File's Hash

Hashes are repeatable — so a different output can only mean a different file.

key ideaHashes are repeatable: the same input always gives the same output. So a different output means a different file.

The syntax

Cryptographic hash functions identify changes in a file because they are repeatable — the same input always produces the same output for a given hash function. That one property is the entire technique.

Where to compute it	Example
the command line	`Get-FileHash` in Windows PowerShell
a website	paste or upload the file; useful for checking a download
specialized software	integrity monitoring tools that hash on a schedule

All three compute the same value for the same file. The output depends only on the input and the function — not on the tool that ran it.

computing a SHA-256 hash in PowerShellthe CED's example command

PS> Get-FileHash testfile -Algorithm SHA256

Algorithm  Hash                                                              Path
---------  ----                                                              ----
SHA256     9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08  testfile

Get-FileHashthe PowerShell cmdlet that computes a digesttestfilethe file being hashed-Algorithm SHA256which hash function to use — the comparison is only valid within one functionthe Hash columnthe value to record for later comparison

Doing it step by step

RepeatableThe property that makes this work: the same input always produces the same output for a given hash function.

DigestThe hash output — a fixed-length value standing in for the file's exact contents.

BaselineA recorded digest taken when the file was believed good. Everything later is compared against it.

MismatchA recomputed digest that differs. It proves the file changed; it says nothing about why.

Hash the file and record the output

A file can be hashed and its hash output recorded. This is the baseline — and it must be taken when you have reason to believe the file is good.

in a known-good file out a recorded digest

Store the digest where it cannot be quietly changed

If an adversary can alter the file and the recorded hash, the check proves nothing. Keep the record separate from the file it describes.

out a trustworthy baseline

Hash the same file again later

Same file, same hash function. Because hashes are repeatable, an unchanged file must produce the identical output.

out a second digest

Compare the two outputs

Identical means the file is unchanged. Different means the file has changed — which may indicate malicious activity.

out a verdict

Investigate a mismatch rather than assuming

A change may be a legitimate edit, a failed transfer, or an attack. The hash tells you that it changed, never why.

out an explanation

Steps two and four carry the weight. Recording the digest somewhere separate is what makes the later comparison meaningful — a hash stored beside the file it protects can be rewritten alongside it.

comparing the recorded and recomputed digeststwo values for the same file, six months apart

# recorded on 2026-01-04
9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08

# recomputed on 2026-07-25
E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855

# different -> the file has changed.

the recorded valuetaken when the file was believed goodthe recomputed valuethe same file, the same function, laterdifferentthe file has changed — hashes are repeatable, so this cannot be noisewhat it does not saywhether the change was malicious — that requires investigation

Worked analysis

EX 1

Verify a download

A vendor publishes a SHA-256 hash beside an installer. How do you use it, and what does a match prove?

Compute the hash locally

Get-FileHash installer.exe -Algorithm SHA256.

Compare with the published value

Character for character — a partial match means nothing.

State what a match proves

The file you have is byte-for-byte the file the vendor hashed.

State what it does not prove

That the vendor's file is safe — only that it arrived intact.

Note the dependency

The check is only as good as the published value. If the site serving the hash was compromised too, both would match.

EX 2

Detect an unexpected change

A configuration file's recorded hash no longer matches. What do you conclude, and what do you do?

State the certain conclusion

The file has changed — hashes are repeatable, so this is not ambiguity.

Resist the second conclusion

It does not follow that the change was malicious.

List the possibilities

A legitimate administrative edit, a failed copy, or malicious activity.

Investigate

Check change records and the file's modification time and author.

State the value

A file that changed unexpectedly is a sign of malicious activity — the hash is what makes ‘unexpectedly’ a detectable condition.

EX 3

Where the baseline lives

An organization stores each file's hash in a text file in the same directory. Assess.

Note that the mechanism works

Hashing and comparison behave exactly as intended.

Ask what an adversary would do

Alter the file, recompute the hash, and overwrite the record.

State the consequence

The comparison passes, and the check has proved nothing.

Give the fix

Store baselines separately — a different system, with different access controls.

State the principle

An integrity check is only as trustworthy as the record it compares against.

Verify the result

four checks

Use the same hash function for both computations — different functions give different outputs by design.
Compare the digests in full; matching the first few characters is not a match.
Store the recorded hash somewhere the file’s owner cannot silently change.
Treat a mismatch as a change, then investigate whether it was legitimate.

Check yourself

Why can a hash identify changes in a file?

Show answer

Because cryptographic hash functions are repeatable: the same input always produces the same output for a given hash function. A different output therefore means a different input.

Where can hashes be calculated?

Show answer

Using the command line — for example Get-FileHash testfile -Algorithm SHA256 in Windows PowerShell — a website, or specialized software.

Describe the verification procedure.

Show answer

Hash the file and record the output; later, hash it again and compare the second output with the first. If the hash has changed, the file has changed.

What does a changed hash tell you, and what does it not?

Show answer

That the file has changed — which can be a sign of malicious activity. It does not say whether the change was malicious, or what changed.

Course map. Topic 5.6.d · LO 5.6.D — identify whether a file has been altered by verifying its hash (EK 5.6.D.1–5.6.D.3: hash functions being repeatable, so the same input always produces the same output; calculating hashes on the command line, a website or specialized software, including Get-FileHash in Windows PowerShell; hashing a file, recording the output, hashing again later and comparing).