Is this copy the same as the original?
A hash is a short fingerprint worked out from the content of a file. If even one character of the file changes, the fingerprint changes completely.
So a hash lets you prove that a copy is the same as the original, and that nobody has edited your evidence.
By the end of this lesson
Note
I can use a hash to prove a file is unchanged and read its metadata.
Key words
| Word | What it means | Example |
|---|---|---|
| Hash | a fixed-length fingerprint worked out from a file's content | |
| Baseline | a list of hashes taken at the start, to compare with later | |
| Metadata | data about a file, such as its owner and times | |
| Modified time | the time the content last changed | |
| Owner | the account that controls a file | |
| Mode | the permissions of a file | 644 |
The cells students fill in are left blank in this preview.
A hash is a fingerprint of content
A hash function reads all the bytes of a file and gives back a number written in hexadecimal. SHA-256 always gives 64 characters, whether the file is one letter or one gigabyte.
The same content always gives the same hash. A different content gives a different hash, even if it differs by one character.
Hash a short text
printf 'invoice 100' | sha256sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Change one character and hash again
printf 'invoice 101' | sha256sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: one character changes everything
| Text | SHA-256 hash |
|---|---|
| invoice 100 | dcd749973453e21279782312cd726c03028ed69267b481285a1affc360350c8e |
| invoice 101 | 72b424430947b5cce4cf9488575455eeed11c1877741c2f1502e416619daa9e1 |
The cells students fill in are left blank in this preview.
Compare hashes to prove a file is unchanged
At the start you write down the hash of each file. This list is your baseline. Later you hash the files again and compare.
If a hash is different, the file changed. The tool sha256sum -c does the comparing for you and prints OK or FAILED for each file.
Check a file against its own hash
sha256sum case/etc/passwd | sha256sum -c -Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Check against a wrong hash
printf '%s case/etc/passwd\n' 0000000000000000000000000000000000000000000000000000000000000000 | sha256sum -c -Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Compare a file with an edited copy
sed 's/root/ROOT/' case/etc/passwd | cmp -s - case/etc/passwd; echo $?Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think a file's modified time proves when it was last changed. Anyone who owns a file can set its time to any date they like. Treat a time as a clue. Use a hash as proof of the content.
Metadata tells you about a file
Metadata is the information the system keeps about a file, apart from its content: its owner, its group, its mode, its size and three times.
The command stat prints it. Metadata helps you decide where to look, but unlike a hash it can be changed.
The three times on a file
| Time | Short name | It changes when |
|---|---|---|
| Modified | mtime | The content changes |
| Accessed | atime | The file is read |
| Changed | ctime | The metadata changes, such as its owner or mode |
The cells students fill in are left blank in this preview.
Owner, group and mode
stat -c "%U %G %a" case/etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Turn a number of seconds into a date
date -u -d @86400 +"%Y-%m-%d %H:%M:%S"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The columns of the lab's time list
head -n 1 case/mtimes.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
How many files share one day
grep -c "2026-09-02" case/mtimes.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further
Run sha256sum case/etc/passwd in your own work folder and in the case. Copy the file with cp without any option, then hash the copy. Compare the three hashes, then compare the modified times with stat -c %y. Write down which one changed and which one did not.