md5deep is a set of programs to compute MD5, SHA-1, SHA-256, Tiger, or Whirlpool message digests on an arbitrary number of files. md5deep is similar to the md5sum program found in the GNU Coreutils package, but has the following additional features:
hashdeep is a program to compute, match, and audit hashsets. With traditional matching, programs report if an input file matched one in a set of knows or if the input file did not match. It's hard to get a complete sense of the state of the input files compared to the set of knowns. It's possible to have matched files, missing files, files that have moved in the set, and to find new files not in the set. Hashdeep can report all of these conditions. It can even spot hash collisions, when an input file matches a known file in one hash algorithm but not in others. The results are displayed in an audit report.
The hash set audit process was described in the paper Auditing Hash Sets: Lessons Learned from Jurassic Park published in the journal Digital Investigation.
For more details and some examples of using hashdeep, check out
the hashdeep getting started guide.
The programs are distributed as binaries for Microsoft Windows (7, Vista, XP, 2003, and 2000 are supported) and as source code. The source code should compile nicely on just about any platform, including Cygwin, Linux, FreeBSD, OpenBSD, Mac OS X, OpenSolaris, HP/UX, etc.
Note that several operating systems support an automatic installation of md5deep through packaging or ports. See the Automatic Installation section of the getting started guide for details.
Microsoft Windows NT and Windows 9x are no longer supported. The last version that works on Windowx 9x was version 1.13. Windows 3.x was never supported.
The latest stable versions of md5deep and hashdeep are now distributed on the GitHub site, https://github.com/jessek/hashdeep/releases.
There is no beta version of md5deep right now. If you have any problems or would like to see something added to md5deep, please send mail to the developer at research@jessekornblum.com or visit the Sourceforge project page .
Although older versions of md5deep and hashdeep
are available for historical purposes,
you shouldn't use these unless you have a truly compelling reason.
Version | Date | Format | Hash |
---|---|---|---|
4.3 | 24 Oct 2012 | Windows binary | SHA256 e46b6e12f1b831f73975a40cff798ddfd81090953ee556e21ec690ca0edde37a |
source code | SHA256 905bcf8bddf0e7e2650b280d5e7af8cb8cd41dad4f299751dfec397dcb4f8d54 | ||
4.2 | 11 Jun 2012 | Windows binary | SHA256 6a6b043df407aef6219cda7f4c68818e6bdfb6f0273b2c320118777a3cd87cf0 |
source code | SHA256 3ec13386cda92d60151e2517359a6d0774a89e9465758b511d827956c3c00aa3 | ||
4.1.1 | 5 Jun 2012 | Windows binary | SHA256 730da24551038af6853f25fcaa38b3cda1dd930f42f13310343a690d169a519d |
source code | SHA256 bcc902b50cb21a4a2a7a3aa2592c5cff8c8e4585bb607b9cafed3b6c2cd5a5d1 | ||
4.1 | 14 Feb 2012 | Windows binary | SHA256 a0fcbf4a2ac56e0294f1132c4dcda7f00ef9ade982ab1e4f9728e37ca1e713cd |
source code | SHA256 07ad289f587c1be5f3403408bb03c1891ce29e5d607ec3b973282661f422966b | ||
4.0.1 | 22 Jan 2012 | Windows binary | SHA256 b6deb5c038b85513f6d9a0ed64fc4d58af0c1fe3de34eb040aa0cd8434f9e475 |
source code | SHA256 79017543fa88c61700874cc7ed3c621069d2ac499d8d1aa145a2be9558e707de | ||
4.0.0 | 6 Jan 2012 | Windows binary | SHA256 cc9c13b38ba63f3b17d9d6b53bae136d23eaa7dfff988c26dfd175273f270d01 |
source code | SHA256 53cf46fd322c412fb666002b77b216e9cf5ca3bccd2251aa69d7482d93b39014 | ||
3.9.2 | 26 Jul 2011 | Windows binary | SHA256 a88dd72d963b44ed534a2b1baee2603d1001ddd37627b2d8ab3d06f0d68e8329 |
source code | SHA256 80327712339aab202cff2b6f9623d4142b2725785cbe6a7e0c913af2a609d857 | ||
3.9.1 | 31 May 2011 | Windows binary | SHA256 2968c1f2748395ca6edb8000cd6cdbb440011482c30fe577c4469d8710d6fc89 |
source code | SHA256 95547dded54ecca057b1e6fa2d253f821ac427bb209c06bafc8eed3193ea54bd | ||
3.9 | 21 Apr 2011 | Windows binary | SHA256 bfcd14f6ab2aff2e109812662f0b18cd47c7022e1b979fe8328489e12f08683b |
source code | SHA256 2bc300761214b607bf27a1c5a8680a6741b82a5a3e85be47dc1e5dc3e8267d4d | ||
3.8 | 15 Apr 2011 | Windows binary | SHA256 ddf0cfc34ae0b604a2110772814d03bafdb25af168c72f48f63057f2b273d640 |
source code | SHA256 7eeccd5043ff65b135b0670ddba5a5652f99d50184491937dba895cb900ce83d | ||
3.7 | 18 Dec 2010 | Windows binary | SHA256 14e0b1b190125e5a95493c65920c750124b6b050b73fcf132b7d0bb464c70580 |
source code | SHA256 23e70b51dd118639d04ad6ed61579e0667a8df78e742f73eaaa6b820a4714b25 | ||
3.6 | 23 Mar 2010 | Windows binary | SHA256 b7d3dbaada5c60395be44114607f641cf4f4dd1f9b415e1219a743dddfd3d187 |
source code | SHA256 1286ce7aa097120f3f763cfb809785973c0661c63bda1128a1ef57fb7352cb6b | ||
3.5.1 | 30 Dec 2009 | Windows binary | SHA256 8be48ae77fde088747f97e626bd81918cde9f7e5af3b8247a30e8c7def11b153 |
source code | SHA256 a6a29f9892fa3a4a48bee0da341fd5dad5cdcdc2aecc521b28cf0b652bb3c415 | ||
3.5 | 22 Dec 2009 | Windows binary | SHA256 6bf03580a7e274101299c116092ef6d1565d66042dc1b89e3e09a6cc5b45f4d3 |
source code | SHA256 917672403a2ea6841be0cfe0da42f9651a9bcb10fdf808cbd83478b02673502a | ||
3.4 | 11 Jun 2009 | Windows binary | SHA256 128e150ac07e9236490a225fa61d39c5c4ad4adadeb17e269da0bb0351813e42 |
source code | SHA256 913b2cbfa57e46392b0a3ed392a07889d283a7ef897a6340b25aea2831a173db | ||
3.3 | 4 Apr 2009 | Windows binary | SHA256 478f176c31a052635ca8b867c574af87c1f9283439ff251a0cb8d260397f30ff |
source code | SHA256 0ecfd1c067a4c73a2de19eb57eef12f882f18a845f2a564392868ed47ee5b343 | ||
3.2 | 25 Jan 2009 | Windows binary | SHA256 9ce08f700b63d0d3067f430b4b1af8f3c3fbf1dfce38653fde135701f8f50ad2 |
source code | SHA256 c2025a3edac4fd7f5f23d084da064324c6f3dcb465a34554786e31730c658334 | ||
3.1 | 23 Jul 2008 | Windows binary | SHA256 5fbe8d9b0b0bec2d591e4fe1d3b38929efdfdec97e5bd7a76df2e1217cafc2d0 |
source code | SHA256 fdcfaa469923248b0412b4a1afab39f5c26ea778edaab51af2d97eed46bcf2af | ||
3.0 | 10 May 2008 | Windows binary | SHA256 d4115f59b9e57a08e2f6a9abebc0ef257a9077311087a9ea1a30a4ceebc0c79b |
source code | SHA256 7af9ca3b271434713b1051776807c570d127a77743c818aef93232800e2201f4 | ||
2.0.1 | 31 Oct 2007 | Windows binary | SHA256 7c047c433de7009ab825205da283a9fdb5f4107a1534774a4a581cd829e0b8e1 |
Cygwin binary | (never released) | ||
source code | SHA256 7ea4ba5257a1e08beb1f05430bf33a9ac311048ed0920dcf6450dad1a75f146d | ||
2.0 | 15 Oct 2007 | Windows binary | SHA256 f680f3de0f592950efaf131821b2d0d77e4882252f015eb2acd6bbc8f846ca8b |
Cygwin binary | SHA256 e6d200ceb7ed0e326226e16a2d7c8bc4c2b074acf64400e070739411528ce284 | ||
source code | SHA256 5b53fbd11fe598e540980e747e6d7508e4ff14f9310c1949c7e7044afac4df32 | ||
1.13 | 6 Aug 2007 | Windows binary | SHA256 0acf6d2d51d56fa413374d765585a58ab1abbab9c167f1fc6426af7ea986318a |
Cygwin binary | (never released) | Source code | SHA256 38a267a5a35444ae584a53afe5db9a643668cc60d94d7f3dcee34778b24127c2 |
1.12 | 3 Apr 2006 | Windows binary | SHA256 d8bc1d242686d4ea59eff38484e50a5789e1288e25b915c3f1f86c09b6e90d82 |
Cygwin binary | SHA256 c7ce267c69906e1c4c5c2e120126764b201d5dd8b0c93da424485301782d86c5 | ||
source code | SHA256 7329647f159735d3014166201057f15e5af551e1daeabc103ec08e6f8c902112 | ||
1.11 | 31 Mar 2006 | Windows binary | SHA256 169a4fe60ddd5331dfffc7ba7b00f7cde632c1eff922807c7c2570cb784b2bfd |
Cygwin binary | (never released) | ||
source code | SHA256 ad865f2d5866074083c78254ce6e73314b238c52e47264a07129eeaa44e109da | ||
1.10 | 2 Feb 2006 | Windows binary | SHA256 d7cad9c8abf3ccd18ccf64e10c7bd8197da7acb17b25380a3d3f6aee7ca5153c |
Cygwin binary | SHA256 0e531d971ef955cfa881814b27c13780e1a67acb57cc8e0a7ee607abff1f5f47 | ||
source code | SHA256 2658956a7e7890d4ebcc1ff152dab9f64e00f71468bc31d120d255476cc7cd8c | ||
1.9.3 | 5 Jan 2006 | Windows binary | SHA256 f12fd601e90b2c1c02b7ac52084970bf4bb34db3321b5c405e04d4c6e43989b9 |
Cygwin binary | SHA256 9ff54d5c263da09fd0c755e308497602add6a75a6e040fab0e0f6de3b2a2bce3 | ||
source code | SHA256 59b66fd801beb87481c178dc9f3485feecdbae55c68c22410b9ce7f20ae7afd1 | ||
1.9.2 | 14 Nov 2005 | Windows binary | SHA256 0c1aec402920325f068ef81122bf33faabd9ea14a06fc620729b63f51d905fd7 |
source code | SHA256 efe4168b445d98f7a8b32565c7c068fc3721f60e10af741600c7f44ec00baeec | ||
1.9.1 | 8 Nov 2005 | Windows binary | SHA256 8e4c46758b47c93d3af0dbdd0d61fdaa75d6fa85e284c6f04529d627d0efdd98 |
source code | SHA256 d72afa7f5ca93e18c92de75a419cd63d551422576a3c5b3cdd04eb0d36e93b97 | ||
1.9 | 7 Nov 2005 | Windows binary | SHA256 e2fb74df42cdbdd7d908f9eb35fab122f59a097a3dc418f3f035abc3adbf087a |
source code | SHA256 8e06f5dd4fc6ff7e93f7807633a2c3319a326a39cef98e40d076cab09369c99b | ||
1.8 | 8 Aug 2005 | Windows binary | MD5 19e982ee81d9ed2fe3e8eb69fad0739a |
source code | MD5 2d6e1d1a337c4a7380567419a0c03947 | ||
1.7 | 23 May 2005 | Windows binary | 0c2f4b8467dc9ef9c3f6c39b151166f4 |
source code | 55fda350be1116f33b846245e9f86cb7 | ||
1.6 | 5 May 2005 | Windows binary | 0e4d2f4817dd2aa52a74abd874402d39 |
source code | b87a26c856798457ed10bc9486178453 | ||
1.5 | 31 Aug 2004 | Windows binary | b5a4538789903e201e76b6169b164f17 |
source code | 14b94d3a38bd4ea6bcd7a6331fae6030 | ||
1.4 | 16 Aug 2004 | Windows binary | 203f88fe704bfc8597aeba0fac4bbe86 |
source code | 1411130dec66079e22beff7afad73df1 | ||
1.3 | 23 Jun 2004 | Windows binary | d1c1eae769e8300b708487f948094cf2 |
source code | b747ef1eb7bc87df079dfa8cac750081 | ||
1.2 | 11 Apr 2004 | Windows binary | c760d94a81bc777bf0ce31dc2f429cec |
source code | 3d699b18d9a824afe44e943807f0e565 | ||
1.1 | 23 Mar 2004 | Windows binary | 95d88abb032620e0c6ed059736c06f7a |
source code | 7437d7e949103ba52828a59523711cce | ||
1.0 | 10 Mar 2004 | Windows binary | 4aca6868dedfc1422af773139de5e25c |
source code | a7399d48e0cfbe20c2a96981d2aa8f38 | ||
0.16 | 6 Mar 2003 | Windows binary | 9a98fe2f11ce9801ab4564acebb05581 |
source code | a07715c3344524da1270e9eb39f9b9e1 | ||
0.15 | 14 Jan 2003 | Windows binary | 4f2b33c774557be2b02ce2d7841cc934 |
source code (does not support Mac) |
3de68fa1a1605086f5673a90b2767484 |
To quote the executive summary of RFC 1321, the official MD5 specification:
[MD5] takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest.Some weaknesses have been found in MD5 and the above statement may no longer be accurate. Please check the current status of MD5 for more information.
The algorithm was originally developed by Professor Ron Rivest of the Massachusetts Institute of Technology. More information on the algorithm can be found in RFC 1321 and in the RSA Cryptography FAQ.
To quote the start of RFC 3174:
[SHA-1 is used] for computing a condensed representation of a message or a data file. When a message of any length < 264 bits is input, the SHA-1 produces a 160-bit output called a message digest.The algorithm was originally developed by the National Institute of Standards and Technology and is officially defined in FIPS 180-1, published in 1995. (The SHA-1 algoritm also appears in FIPS 180-2, published in 2002. Although the algorithm was not changed, some of the notation was changed to make it more consistent with other algorithms.)
Some weaknesses have been found in SHA-1 and the above statements may no longer be accurate. Please check the current status of SHA-1 for more information.
To quote the start of FIPS 180-2:
This Standard specifies ... secure hash algorithms ... for computing a condensed representation of electronic data (message). When a message of any length < 264 bits is input to [SHA-256] , the result is an output called a message digest.The algorithm was originally developed by the National Institute of Standards and Technology and is officially defined in FIPS 180-2, published in 2002.
Tiger is a hashing function developed in 1995 by Ross Anderson and Eli Biham. The algorithm produces a 192 bit output, but truncated versions of 160 and 128 bits, called Tiger/160 and Tiger/128 also exist. A second version of the algorithm, Tiger2, is identical to the original except for the padding method. The padding in Tiger2 is the same as MD5 and SHA-1. You can read more about Tiger at the official Tiger website.
Tigerdeep, the program included in this package, produces Tiger/192 hashes in the same format as the NESSIE standard. Use the NESSIE formatted test vectors for Tiger to check your version of tigerdeep.
According to the official Whirlpool homepage,
Whirlpool is a hash function designed by Vincent Rijmen and Paulo S. L. M. Barreto that operates on messages less than 2256 bits in length, and produces a message digest of 512 bits. ... the final version (called simply WHIRLPOOL for short) was adopted by the International Organization for Standardization (ISO) in the ISO/IEC 10118-3:2004 standard.
These programs were written and are now maintained by Jesse Kornblum. At the time md5deep was originally written, Mr. Kornblum was a Special Agent with the United States Air Force Office of Special Investigations (AFOSI). As such, the program is considered to be a work of the United States Government. Under 17 USC 105, works of the United States Government are not eligible for copyright protection.
Please send all correspondence to research@jessekornblum.com.