Sérgio’s blog

Some Internet available software, normally free software, provides a checksum for file integrity testing.

What is this for? By checking that the checksum of the downloaded file matches the checksum provided on the source web site you’ll have a guarantee that the file was not modified (hacked) – unless the web site checksum was too..

So on windows how do you verify this?

There’s a tool (fciv.exe) provided by Microsoft(r) that can compute sha1 and md5 checksums. You can download it at http://support.microsoft.com/kb/841290.

After downloading it, you can extract it to c:\windows\ to make the command widely available.

Next you can verify the checksum of a downloaded file, say for example the gnupg installation package for windows. On the web site the sha1 checksum was published. Let’s verify it:

C:\external\Software\gnupg>fciv gnupg-w32cli-1.4.9.exe -sha1
//
// File Checksum Integrity Verifier version 2.05.
//
c2efad983dfe50e6d8007257bad2c76604be389a gnupg-w32cli-1.4.9.exe

Great, it matches it so the file has it’s integrity intact.

To make things easier we can create the commands sha1sum and md5sum which are normally the standard command names to check sha1 and md5.

Let’s create 2 batch files, for sha1 let’s put the following contents and save it as c:\windows\sha1sum.bat:

@echo off
fciv %1 -sha1

and for md5 let’s put the following contents and save it as c:\windows\md5sum.bat:

@echo off
fciv %1

Now we can compute the checksums by calling these commands:

C:\external\Software\gnupg>sha1sum gnupg-w32cli-1.4.9.exe
//
// File Checksum Integrity Verifier version 2.05.
//
c2efad983dfe50e6d8007257bad2c76604be389a gnupg-w32cli-1.4.9.exe

C:\external\Software\gnupg>md5sum gnupg-w32cli-1.4.9.exe
//
// File Checksum Integrity Verifier version 2.05.
//
d90854104edcb72149472a99a9392d4e gnupg-w32cli-1.4.9.exe