Verify File Integrity on Linux with md5sum and Automated Checks

Generating MD5 checksums

The md5sum utility reads a file’s contents and prints a 128‑bit MD5 hash. Because the hash is computed only from the data stream, changes to file permissions, timestamps, or other metadata do not affect the result.

# Copy a file for testing
cp -a /etc/fstab /tmp/fstab
cp -a /etc/fstab /tmp/fstab1

# Compute hashes for both copies
md5sum /tmp/fstab /tmp/fstab1

Typical output shows identical hashes when the files are byte‑for‑byte identical:

a612cd5d162e4620b442b0ff3474bf98  /tmp/fstab
a612cd5d162e4620b442b0ff3474bf98  /tmp/fstab1

Saving checksums for later verification

Redirect the output of md5sum to a file (commonly with a .md5sum suffix). This file contains one line per source file: the hash followed by the file path.

# Store the hashes
md5sum /tmp/fstab /tmp/fstab1 > /tmp/fs.md5sum

Verifying file integrity

Use the -c (or --check) option to compare the current contents of each listed file against the stored hash.

# Verify both files
md5sum -c /tmp/fs.md5sum

Expected output:

/tmp/fstab: OK
/tmp/fstab1: OK

If a file’s contents change, the verification reports FAILED and prints a warning.

# Append data to one file
echo aaa >> /tmp/fstab1

# Re‑run verification
md5sum -c /tmp/fs.md5sum

/tmp/fstab: OK
/tmp/fstab1: FAILED
md5sum: WARNING: 1 of 2 computed checksums did NOT match

Additional verification options

--quiet : suppress output for files that pass verification (only failures are shown). --status : produce no output at all; the command’s exit status indicates success (0) or failure (1). This is useful in scripts.

# Use --status and inspect the exit code
md5sum --status -c /tmp/fs.md5sum
echo $?

The exit code will be 0 if all files match, otherwise 1.

Automating batch integrity checks

For large collections of files, embed the verification step in a shell loop or script. Example skeleton:

#!/bin/bash
checksum_file="/path/to/checksums.md5"
md5sum --status -c "$checksum_file"
if [ $? -eq 0 ]; then
    echo "All files are intact"
else
    echo "Some files have been modified"
    # Additional handling, e.g., logging or alerting
fi

This approach scales to thousands of files without manual inspection.