md5deep and hashdeep

# md5deep and hashdeep - Latest version 4.3

## Quick Links

- Download md5deep and hashdeep
- Manual pages for md5deep, hashdeep
- Getting started guides for md5deep, hashdeep
- Donate to the project
- Sourceforge project page - Home to development and feature requests

## Introduction

md5deep is a set of programs to compute MD5, SHA-1, SHA-256, Tiger, or Whirlpool message digests on an arbitrary number of files. md5deep is similar to the md5sum program found in the GNU Coreutils package, but has the following additional features:

- Recursive operation - md5deep is able to recursive examine an entire directory tree. That is, compute the MD5 for every file in a directory and for every file in every subdirectory.
- Comparison mode - md5deep can accept a list of known hashes and compare them to a set of input files. The program can display either those input files that match the list of known hashes or those that do not match. Hashes sets can be drawn from Encase, the National Software Reference Library, iLook Investigator, Hashkeeper, md5sum, BSD md5, and other generic hash generating programs. Users are welcome to add functionality to read other formats too!
- Time estimation - md5deep can produce a time estimate when it's processing very large files.
- Piecewise hashing - Hash input files in arbitrary sized blocks
- File type mode - md5deep can process only files of a certain type, such as regular files, block devices, etc.

hashdeep is a program to compute, match, and audit hashsets. With traditional matching, programs report if an input file matched one in a set of knows or if the input file did not match. It's hard to get a complete sense of the state of the input files compared to the set of knowns. It's possible to have matched files, missing files, files that have moved in the set, and to find new files not in the set. Hashdeep can report all of these conditions. It can even spot hash collisions, when an input file matches a known file in one hash algorithm but not in others. The results are displayed in an audit report.

The hash set audit process was described in the paper Auditing Hash Sets: Lessons Learned from Jurassic Park published in the journal Digital Investigation.

For more details and some examples of using hashdeep, check out the hashdeep getting started guide.

## Supported Platforms

The programs are distributed as binaries for Microsoft Windows (7, Vista, XP, 2003, and 2000 are supported) and as source code. The source code should compile nicely on just about any platform, including Cygwin, Linux, FreeBSD, OpenBSD, Mac OS X, OpenSolaris, HP/UX, etc.

Note that several operating systems support an automatic installation of md5deep through packaging or ports. See the Automatic Installation section of the getting started guide for details.

Microsoft Windows NT and Windows 9x are no longer supported. The last version that works on Windowx 9x was version 1.13. Windows 3.x was never supported.

## Download md5deep and hashdeep

### Stable Version

The latest stable versions of md5deep and hashdeep are version 4.3 and were released on 24 Oct 2012. You can take a look at the complete changelog, but here are the changes in the latest version:

#### Bug Fixes

- Proper hash generation on big endian systems
- Allows compilation on OpenSolaris

Version 4.3 | 24 Oct 2012 | Windows binary | SHA256 e46b6e12f1b831f73975a40cff798ddfd81090953ee556e21ec690ca0edde37a
source code | SHA256 905bcf8bddf0e7e2650b280d5e7af8cb8cd41dad4f299751dfec397dcb4f8d54

### Beta Version

There is no beta version of md5deep right now. If you have any problems or would like to see something added to md5deep, please send mail to the developer at research@jessekornblum.com or visit the Sourceforge project page .

### Older Versions

Although older versions of md5deep and hashdeep are available for historical purposes, you shouldn't use these unless you have a truly compelling reason.

Version | Date | Format | Hash
--- | --- | --- | ---
4.2 | 11 Jun 2012 | Windows binary | SHA256 6a6b043df407aef6219cda7f4c68818e6bdfb6f0273b2c320118777a3cd87cf0
source code | SHA256 3ec13386cda92d60151e2517359a6d0774a89e9465758b511d827956c3c00aa3
4.1.1 | 5 Jun 2012 | Windows binary | SHA256 730da24551038af6853f25fcaa38b3cda1dd930f42f13310343a690d169a519d
source code | SHA256 bcc902b50cb21a4a2a7a3aa2592c5cff8c8e4585bb607b9cafed3b6c2cd5a5d1
4.1 | 14 Feb 2012 | Windows binary | SHA256 a0fcbf4a2ac56e0294f1132c4dcda7f00ef9ade982ab1e4f9728e37ca1e713cd
source code | SHA256 07ad289f587c1be5f3403408bb03c1891ce29e5d607ec3b973282661f422966b
4.0.1 | 22 Jan 2012 | Windows binary | SHA256 b6deb5c038b85513f6d9a0ed64fc4d58af0c1fe3de34eb040aa0cd8434f9e475
source code | SHA256 79017543fa88c61700874cc7ed3c621069d2ac499d8d1aa145a2be9558e707de
4.0.0 | 6 Jan 2012 | Windows binary | SHA256 cc9c13b38ba63f3b17d9d6b53bae136d23eaa7dfff988c26dfd175273f270d01
source code | SHA256 53cf46fd322c412fb666002b77b216e9cf5ca3bccd2251aa69d7482d93b39014
3.9.2 | 26 Jul 2011 | Windows binary | SHA256 a88dd72d963b44ed534a2b1baee2603d1001ddd37627b2d8ab3d06f0d68e8329
source code | SHA256 80327712339aab202cff2b6f9623d4142b2725785cbe6a7e0c913af2a609d857
3.9.1 | 31 May 2011 | Windows binary | SHA256 2968c1f2748395ca6edb8000cd6cdbb440011482c30fe577c4469d8710d6fc89
source code | SHA256 95547dded54ecca057b1e6fa2d253f821ac427bb209c06bafc8eed3193ea54bd
3.9 | 21 Apr 2011 | Windows binary | SHA256 bfcd14f6ab2aff2e109812662f0b18cd47c7022e1b979fe8328489e12f08683b
source code | SHA256 2bc300761214b607bf27a1c5a8680a6741b82a5a3e85be47dc1e5dc3e8267d4d
3.8 | 15 Apr 2011 | Windows binary | SHA256 ddf0cfc34ae0b604a2110772814d03bafdb25af168c72f48f63057f2b273d640
source code | SHA256 7eeccd5043ff65b135b0670ddba5a5652f99d50184491937dba895cb900ce83d
3.7 | 18 Dec 2010 | Windows binary | SHA256 14e0b1b190125e5a95493c65920c750124b6b050b73fcf132b7d0bb464c70580
source code | SHA256 23e70b51dd118639d04ad6ed61579e0667a8df78e742f73eaaa6b820a4714b25
3.6 | 23 Mar 2010 | Windows binary | SHA256 b7d3dbaada5c60395be44114607f641cf4f4dd1f9b415e1219a743dddfd3d187
source code | SHA256 1286ce7aa097120f3f763cfb809785973c0661c63bda1128a1ef57fb7352cb6b
3.5.1 | 30 Dec 2009 | Windows binary | SHA256 8be48ae77fde088747f97e626bd81918cde9f7e5af3b8247a30e8c7def11b153
source code | SHA256 a6a29f9892fa3a4a48bee0da341fd5dad5cdcdc2aecc521b28cf0b652bb3c415
3.5 | 22 Dec 2009 | Windows binary | SHA256 6bf03580a7e274101299c116092ef6d1565d66042dc1b89e3e09a6cc5b45f4d3
source code | SHA256 917672403a2ea6841be0cfe0da42f9651a9bcb10fdf808cbd83478b02673502a
3.4 | 11 Jun 2009 | Windows binary | SHA256 128e150ac07e9236490a225fa61d39c5c4ad4adadeb17e269da0bb0351813e42
source code | SHA256 913b2cbfa57e46392b0a3ed392a07889d283a7ef897a6340b25aea2831a173db
3.3 | 4 Apr 2009 | Windows binary | SHA256 478f176c31a052635ca8b867c574af87c1f9283439ff251a0cb8d260397f30ff
source code | SHA256 0ecfd1c067a4c73a2de19eb57eef12f882f18a845f2a564392868ed47ee5b343
3.2 | 25 Jan 2009 | Windows binary | SHA256 9ce08f700b63d0d3067f430b4b1af8f3c3fbf1dfce38653fde135701f8f50ad2
source code | SHA256 c2025a3edac4fd7f5f23d084da064324c6f3dcb465a34554786e31730c658334
3.1 | 23 Jul 2008 | Windows binary | SHA256 5fbe8d9b0b0bec2d591e4fe1d3b38929efdfdec97e5bd7a76df2e1217cafc2d0
source code | SHA256 fdcfaa469923248b0412b4a1afab39f5c26ea778edaab51af2d97eed46bcf2af
3.0 | 10 May 2008 | Windows binary | SHA256 d4115f59b9e57a08e2f6a9abebc0ef257a9077311087a9ea1a30a4ceebc0c79b
source code | SHA256 7af9ca3b271434713b1051776807c570d127a77743c818aef93232800e2201f4
2.0.1 | 31 Oct 2007 | Windows binary | SHA256 7c047c433de7009ab825205da283a9fdb5f4107a1534774a4a581cd829e0b8e1
Cygwin binary | (never released)
source code | SHA256 7ea4ba5257a1e08beb1f05430bf33a9ac311048ed0920dcf6450dad1a75f146d
2.0 | 15 Oct 2007 | Windows binary | SHA256 f680f3de0f592950efaf131821b2d0d77e4882252f015eb2acd6bbc8f846ca8b
Cygwin binary | SHA256 e6d200ceb7ed0e326226e16a2d7c8bc4c2b074acf64400e070739411528ce284
source code | SHA256 5b53fbd11fe598e540980e747e6d7508e4ff14f9310c1949c7e7044afac4df32
1.13 | 6 Aug 2007 | Windows binary | SHA256 0acf6d2d51d56fa413374d765585a58ab1abbab9c167f1fc6426af7ea986318a
Cygwin binary | (never released)
| Source code | SHA256 38a267a5a35444ae584a53afe5db9a643668cc60d94d7f3dcee34778b24127c2
1.12 | 3 Apr 2006 | Windows binary | SHA256 d8bc1d242686d4ea59eff38484e50a5789e1288e25b915c3f1f86c09b6e90d82
Cygwin binary | SHA256 c7ce267c69906e1c4c5c2e120126764b201d5dd8b0c93da424485301782d86c5
source code | SHA256 7329647f159735d3014166201057f15e5af551e1daeabc103ec08e6f8c902112
1.11 | 31 Mar 2006 | Windows binary | SHA256 169a4fe60ddd5331dfffc7ba7b00f7cde632c1eff922807c7c2570cb784b2bfd
Cygwin binary | (never released)
source code | SHA256 ad865f2d5866074083c78254ce6e73314b238c52e47264a07129eeaa44e109da
1.10 | 2 Feb 2006 | Windows binary | SHA256 d7cad9c8abf3ccd18ccf64e10c7bd8197da7acb17b25380a3d3f6aee7ca5153c
Cygwin binary | SHA256 0e531d971ef955cfa881814b27c13780e1a67acb57cc8e0a7ee607abff1f5f47
source code | SHA256 2658956a7e7890d4ebcc1ff152dab9f64e00f71468bc31d120d255476cc7cd8c
1.9.3 | 5 Jan 2006 | Windows binary | SHA256 f12fd601e90b2c1c02b7ac52084970bf4bb34db3321b5c405e04d4c6e43989b9
Cygwin binary | SHA256 9ff54d5c263da09fd0c755e308497602add6a75a6e040fab0e0f6de3b2a2bce3
source code | SHA256 59b66fd801beb87481c178dc9f3485feecdbae55c68c22410b9ce7f20ae7afd1
1.9.2 | 14 Nov 2005 | Windows binary | SHA256 0c1aec402920325f068ef81122bf33faabd9ea14a06fc620729b63f51d905fd7
source code | SHA256 efe4168b445d98f7a8b32565c7c068fc3721f60e10af741600c7f44ec00baeec
1.9.1 | 8 Nov 2005 | Windows binary | SHA256 8e4c46758b47c93d3af0dbdd0d61fdaa75d6fa85e284c6f04529d627d0efdd98
source code | SHA256 d72afa7f5ca93e18c92de75a419cd63d551422576a3c5b3cdd04eb0d36e93b97
1.9 | 7 Nov 2005 | Windows binary | SHA256 e2fb74df42cdbdd7d908f9eb35fab122f59a097a3dc418f3f035abc3adbf087a
source code | SHA256 8e06f5dd4fc6ff7e93f7807633a2c3319a326a39cef98e40d076cab09369c99b
1.8 | 8 Aug 2005 | Windows binary | MD5 19e982ee81d9ed2fe3e8eb69fad0739a
source code | MD5 2d6e1d1a337c4a7380567419a0c03947
1.7 | 23 May 2005 | Windows binary | 0c2f4b8467dc9ef9c3f6c39b151166f4
source code | 55fda350be1116f33b846245e9f86cb7
1.6 | 5 May 2005 | Windows binary | 0e4d2f4817dd2aa52a74abd874402d39
source code | b87a26c856798457ed10bc9486178453
1.5 | 31 Aug 2004 | Windows binary | b5a4538789903e201e76b6169b164f17
source code | 14b94d3a38bd4ea6bcd7a6331fae6030
1.4 | 16 Aug 2004 | Windows binary | 203f88fe704bfc8597aeba0fac4bbe86
source code | 1411130dec66079e22beff7afad73df1
1.3 | 23 Jun 2004 | Windows binary | d1c1eae769e8300b708487f948094cf2
source code | b747ef1eb7bc87df079dfa8cac750081
1.2 | 11 Apr 2004 | Windows binary | c760d94a81bc777bf0ce31dc2f429cec
source code | 3d699b18d9a824afe44e943807f0e565
1.1 | 23 Mar 2004 | Windows binary | 95d88abb032620e0c6ed059736c06f7a
source code | 7437d7e949103ba52828a59523711cce
1.0 | 10 Mar 2004 | Windows binary | 4aca6868dedfc1422af773139de5e25c
source code | a7399d48e0cfbe20c2a96981d2aa8f38
0.16 | 6 Mar 2003 | Windows binary | 9a98fe2f11ce9801ab4564acebb05581
source code | a07715c3344524da1270e9eb39f9b9e1
0.15 | 14 Jan 2003 | Windows binary | 4f2b33c774557be2b02ce2d7841cc934
source code (does not support Mac) | 3de68fa1a1605086f5673a90b2767484

## The Hashing Algorithms

### MD5

To quote the executive summary of RFC 1321, the official MD5 specification:

> [MD5] takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest.

Some weaknesses have been found in MD5 and the above statement may no longer be accurate. Please check the current status of MD5 for more information.

The algorithm was originally developed by Professor Ron Rivest of the Massachusetts Institute of Technology. More information on the algorithm can be found in RFC 1321 and in the RSA Cryptography FAQ.

### SHA-1

To quote the start of RFC 3174:

> [SHA-1 is used] for computing a condensed representation of a message or a data file. When a message of any length < 264 bits is input, the SHA-1 produces a 160-bit output called a message digest.

The algorithm was originally developed by the National Institute of Standards and Technology and is officially defined in FIPS 180-1, published in 1995. (The SHA-1 algoritm also appears in FIPS 180-2, published in 2002. Although the algorithm was not changed, some of the notation was changed to make it more consistent with other algorithms.)

Some weaknesses have been found in SHA-1 and the above statements may no longer be accurate. Please check the current status of SHA-1 for more information.

### SHA-256

To quote the start of FIPS 180-2:

> This Standard specifies ... secure hash algorithms ... for computing a condensed representation of electronic data (message). When a message of any length < 264 bits is input to [SHA-256] , the result is an output called a message digest.

The algorithm was originally developed by the National Institute of Standards and Technology and is officially defined in FIPS 180-2, published in 2002.

### Tiger

Tiger is a hashing function developed in 1995 by Ross Anderson and Eli Biham. The algorithm produces a 192 bit output, but truncated versions of 160 and 128 bits, called Tiger/160 and Tiger/128 also exist. A second version of the algorithm, Tiger2, is identical to the original except for the padding method. The padding in Tiger2 is the same as MD5 and SHA-1. You can read more about Tiger at the official Tiger website.

Tigerdeep, the program included in this package, produces Tiger/192 hashes in the same format as the NESSIE standard. Use the NESSIE formatted test vectors for Tiger to check your version of tigerdeep.

### Whirlpool

According to the official Whirlpool homepage,

> Whirlpool is a hash function designed by Vincent Rijmen and Paulo S. L. M. Barreto that operates on messages less than 2256 bits in length, and produces a message digest of 512 bits. ... the final version (called simply WHIRLPOOL for short) was adopted by the International Organization for Standardization (ISO) in the ISO/IEC 10118-3:2004 standard.

## About the developer

These programs were written and are now maintained by Jesse Kornblum. At the time md5deep was originally written, Mr. Kornblum was a Special Agent with the United States Air Force Office of Special Investigations (AFOSI). As such, the program is considered to be a work of the United States Government. Under 17 USC 105, works of the United States Government are not eligible for copyright protection.

Please send all correspondence to research@jessekornblum.com.

## Acknowledgements

The developer wishes to thank Andreas Bussjaeger, Peter Chuenkov (aka ODB), Jeff Bryner, Matt Kucenski, Derek Jones, Daniel B. Sedory, Christopher T. Beers, Christophe Devine, Brian Carrier, Matt Harris, Derrick Donnelly, Matt Johnson, Dewayne Duff, Kris Kendall, Paul Alvarez, Ray Gagne, and Ed Kong. The testing of this program was made possible in part thanks to the generosity of the Computer Science Department at the University of Iowa.