Hashing it Out in PowerShell: Using Get-FileHash

Posted on January 12, 2015 by Jeff Hicks in PowerShell with 0 Comments

PowerShell 4.0 introduced a new cmdlet, Get-FileHash, primarily for use with Desired State Configuration (DSC). In a pull server configuration, you need to provide file hashes so that servers can recognize changes. That is the primary purpose of a file hash as far as I am concerned is for file integrity. Windows supports several different hashing algorithms, which you should not confuse with encryption.

All a hashing algorithm does is calculate a hash value, also usually referred to as a checksum. If the file changes in any way, even with the addition or removal of a single character, then the next time the hash is calculated it will be different.

The hash can’t tell you what changed, only that the current version of the file is different than the original based on the hash. Let’s look at some ways of using file hashes in PowerShell, outside of DSC.

To create a hash, all you need is a file.

Creating a hash with Windows PowerShell. (Image Credit: Jeff Hicks)

Creating a hash with Windows PowerShell. (Image Credit: Jeff Hicks) 

The default hashing algorithm in SHA256, but you can use any of these:

  • SHA1
  • SHA256
  • SHA384
  • SHA512
  • MACTripleDES
  • MD5
  • RIPEMD160

I’m not going to explain each algorithm, as I don’t think it really matters. All we are doing is calculating a file hash, and as long as you use the same algorithm to compare two files I don’t think it makes a difference. For the most part all of these perform reasonably well, especially on small files. Once you start getting into gigabyte size files, then you might notice a difference. In fact, I put together a simple performance testing script.

Sponsored

My script takes a file as input and measures how long it takes to generate a hash using each algorithm.

Using a PowerShell to determine how long it will take to generate a hash. (Image Credit: Jeff Hicks)

Using a PowerShell to determine how long it will take to generate a hash. (Image Credit: Jeff Hicks)

 

Even on smaller files you will most likely see hashing performance like this. The default SHA256 definitely requires a bit of time to calculate. Personally, I see no reason not to use MD5 for file hashes. It is fast and ubiquitous.

Using MD5 for file hashes in PowerShell. (Image Credit: Jeff Hicks)

Using MD5 for file hashes in PowerShell. (Image Credit: Jeff Hicks) 

If you want to use this as a default, add it to $PSDefaultParameterValues.

You would insert this command into your PowerShell profile script. Now Get-FileHash will use this algorithm by default.

Running your chosen algorithm by default with get-filehash. (Image Credit: Jeff Hicks)

Running your chosen algorithm by default with get-filehash. (Image Credit: Jeff Hicks)

Next, let’s see how you might use file hashes. First, I want to calculate file hashes for a group of files and export the results to XML.

I prefer to keep hash information in separate directory on the off chance that a bad actor might try to fudge the original file hashes. At some later date, I import the XML file to access the original file hashes.

At some point after the original file hashes where generated, some of the zip files change. I can use the information from the XML file to compare the stored file hash against a new version, making sure to use the same algorithm. Any files that don’t match are piped to the end.

If the file still exists, it will be displayed.

Checking if the zip file has changed. (Image Credit: Jeff Hicks)

Checking if the zip file has changed. (Image Credit: Jeff Hicks)

Next, let’s see how we might use this cmdlet with copying files. If the file hash between the original file and the copy is different, then something happened during the copy process and the file is most likely corrupt. Here’s how you might copy a single file.

The only reason I’m using Write-Host is to make it clear what I’m doing and if there is a problem copying the file.

Using a script to copy a single file. (Image Credit: Jeff Hicks)

Using a script to copy a single file. (Image Credit: Jeff Hicks)

This same technique would work for multiple files as well.

The only thing I changed was the destination and the files to be copied. I used my NAS with the hope that there might be a network hiccup and cause a problem, but the copy still worked.

Copying a file in Windows PowerShell. (Image Credit: Jeff Hicks)

Copying a file in Windows PowerShell. (Image Credit: Jeff Hicks)

The last thing I thought I would try is create a proxy function for Copy-Item. My version is essentially Copy-Item, but it also calculates a file hash for each file before it is copied and after. If the file hashes don’t match, PowerShell will throw an exception.

This function includes the same algorithm parameter as Get-FileHash, although I set my default to MD5 for performance. I haven’t tested this function under all situations, but it seems to work for simple file copies.

If you use –Passthru and save the results, as I’m doing with OutVariable, the resulting object will include custom properties showing the original and file copy hashes.

Using format-list name. (Image Credit: Jeff Hicks)

I included code in the function that you can enable if you want to artificially introduce hashing errors for testing purposes. Comment out this line:

Sponsored

And uncomment this:

Resulting errors from hashing in Windows PowerShell. (Image Credit: Jeff Hicks)

Resulting errors from hashing in Windows PowerShell. (Image Credit: Jeff Hicks)

Now I have some errors. Hopefully you will never see that many when copying files and comparing file hashes. But if you did, it would be a red flag that you have trouble in River City.

Be sure to take a few minutes to read full help and examples for Get-FileHash and if you are using it in your scripts or tasks, I’d love read about it in the comments.

Sponsored

Tagged with , ,