For obvious reasons I have been a little more concerned with security lately and so have been modifying my trust behavior on my windows machine when running programs or commands. Somewhere I’ve lost in a forum, someone was building a powershell module(that I will embed below) that could be set like a cron job that would get a file hash for every file in a folder you selected, and keep a history of easily checked file changes, and I think I’m going to have to implement something like that, but this morning I stumbled across a post here at eleven forums that is a game changer for Win11 admins. You can natively add powershell file hashing capability to the context menu of file explorer by,,, gasp adding registry keys. I know I hate touching the registry and was suspicious, so rather than copy the file there for download I copied it into a text editor and read it until I was confident it wasn’t malicious. Just run it as a .reg file with regedit and you’re golden. There are some benefits to Redmond’s involvement with Linux these days. Big thanks to Brink at eleven forums for posting the .reg
Written by
Brink
Administrator
Here’s the reg file.
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT*\shell\hash]
“MUIVerb”=”Hash value”
“SubCommands”=””
; SHA1
[HKEY_CLASSES_ROOT*\shell\hash\shell\01menu]
“MUIVerb”=”SHA1”
[HKEY_CLASSES_ROOT*\shell\hash\shell\01menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm SHA1 | format-list”
; SHA256
[HKEY_CLASSES_ROOT*\shell\hash\shell\02menu]
“MUIVerb”=”SHA256”
[HKEY_CLASSES_ROOT*\shell\hash\shell\02menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm SHA256 | format-list”
; SHA384
[HKEY_CLASSES_ROOT*\shell\hash\shell\03menu]
“MUIVerb”=”SHA384”
[HKEY_CLASSES_ROOT*\shell\hash\shell\03menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm SHA384 | format-list”
; SHA512
[HKEY_CLASSES_ROOT*\shell\hash\shell\04menu]
“MUIVerb”=”SHA512”
[HKEY_CLASSES_ROOT*\shell\hash\shell\04menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm SHA512 | format-list”
; MACTripleDES
[HKEY_CLASSES_ROOT*\shell\hash\shell\05menu]
“MUIVerb”=”MACTripleDES”
[HKEY_CLASSES_ROOT*\shell\hash\shell\05menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm MACTripleDES | format-list”
; MD5
[HKEY_CLASSES_ROOT*\shell\hash\shell\06menu]
“MUIVerb”=”MD5”
[HKEY_CLASSES_ROOT*\shell\hash\shell\06menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm MD5 | format-list”
; RIPEMD160
[HKEY_CLASSES_ROOT*\shell\hash\shell\07menu]
“MUIVerb”=”RIPEMD160”
[HKEY_CLASSES_ROOT*\shell\hash\shell\07menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm RIPEMD160 | format-list”
; Allget-filehash -literalpath ‘%1’ -algorithm RIPEMD160 | format-list
[HKEY_CLASSES_ROOT*\shell\hash\shell\08menu]
“CommandFlags”=dword:00000020
“MUIVerb”=”Show all”
[HKEY_CLASSES_ROOT*\shell\hash\shell\08menu\command]
@=”powershell -noexit get-filehash -literalpath \\”%1\\” -algorithm SHA1 | format-list;get-filehash -literalpath \\”%1\\” -algorithm SHA256 | format-list;get-filehash -literalpath \\”%1\\” -algorithm SHA384 | format-list;get-filehash -literalpath \\”%1\\” -algorithm SHA512 | format-list;get-filehash -literalpath \\”%1\\” -algorithm MACTripleDES | format-list;get-filehash -literalpath \\”%1\\” -algorithm MD5 | format-list;get-filehash -literalpath \\”%1\\” -algorithm RIPEMD160 | format-list”
And the powershell script that I found earlier
function Out-HashFiles
{
<#
.SYNOPSIS
Calculates hashes and saves as file.
.DESCRIPTION
This script recursively searches the ScanPath for files larger than the specified size. Then creates a .md5 or .sha1 file in the same directory and with the same name as the source file. The hash of the source file is stored in inside this .md5/.sha1 file.
.PARAMETER $ScanPath
The path that will be recursively searched for files.
.PARAMETER $Algorithm
Specify whether to use MD5 or SHA1 algorithm to hash. Default is SHA1
No speed or CPU load difference when I tested.
.PARAMETER $LargerThan
Hash files larger than specified size in bytes.
1000 = 1 Thousand = 1KB
1000000 = 1 Million = 1MB
1000000000 = 1 BIllion = 1GB
.PARAMETER $Depth
How deep to recursively search for files
.NOTES
Author: Michael Yamry
.EXAMPLE
PS C:\> Out-HashFiles -ScanPath "C:\test\" -LargerThanFileSize 0
Hash all files in test folder using the default algorithm of SHA1 and recursive depth of 5.
.EXAMPLE
Out-HashFiles -ScanPath "C:\test\" -Algorithm SHA1 -LargerThan 100MB -Depth 5 -Verbose
Hash files larger than 100MB using SHA1 algorithm. Only recursively searches 5 levels deep.
.INPUTS
None
.OUTPUTS
None
#>
[CmdletBinding()]
param(
[Parameter(Position=0, Mandatory=$false)]
[ValidateScript({Test-Path -LiteralPath $_ -PathType Container})]
[System.String]$ScanPath = "\\skynet.local\DFS\Video",
[Parameter(Position=1, Mandatory=$false)]
[ValidateSet("SHA1", "MD5", IgnoreCase = $true)]
[System.String]$Algorithm="SHA1",
[Parameter(Position=2, Mandatory=$false)]
[ValidateNotNull()]
[System.Int32]$LargerThan=100MB,
[Parameter(Position=3, Mandatory=$false)]
[ValidateNotNull()]
[System.Int32]$Depth=5
)
BEGIN
{
Write-Host -Object "`r`n`r`n`r`n`r`n" #Four character returns so progress bar does not cover output
}
PROCESS
{
#Find large files in scanpath
Write-Verbose "Scanning path: $ScanPath"
$LargeFiles = Get-ChildItem -Path $ScanPath -Recurse -Depth $Depth -Exclude "*.md5", "*.sha1", "*.json", "*.nfo", "*.srt", "*.sub" | Select-Object FullName, Name, Length | Where-Object {$_.length -GT $LargerThan}
#Count total number of files it will scan
$FoundFileCount = ($LargeFiles | Measure-Object).Count
Write-Verbose "INFO: $FoundFileCount files larger than $([math]::Round($LargerThan/1MB)) MB found"
#Loop through each file and build custom object with info such as name, length, and if has file exists already
Write-Verbose "Parsing $FoundFileCount files and checking if hash file already exists."
#$i = 0
$ParsedFiles = foreach ($File in $LargeFiles)
{
#Progress bar, when writing progress it takes 4 minutes, when not writing progress it takes 20 seconds
#$i++
#Write-Progress -Activity "Analyzing Files" -status "Working on $i/$FoundFileCount - $($File.Name)" -percentComplete ($i / $FoundFileCount*100)
#Build object
[PSCustomObject]@{
Name = $File.Name
FullName = $File.FullName
HashFilePath = ($File.FullName + ".json")
Length = $File.Length
HashFileExists = $(Test-Path -LiteralPath $($File.FullName + ".json")) #True if hash file exists
}
}
#Select only files not hashed from object
$FilesNotYetHashed = $ParsedFiles | Where-Object {$_.HashFileExists -eq $false}
#Calculate number of files not yet hashed
$NumberOfFilesNotYetHashed = $FilesNotYetHashed | Measure-Object | Select-Object -ExpandProperty Count
Write-Verbose "INFO: $($FoundFileCount - $NumberOfFilesNotYetHashed) files found already hashed"
Write-Verbose "Hashing $NumberOfFilesNotYetHashed files."
#Calculate size of files not hashed
$BytesToHash = $FilesNotYetHashed | Measure-Object -Property Length -Sum | Select-Object -ExpandProperty Sum
Write-Verbose "INFO: $([math]::Round($BytesToHash / 1GB)) GB to hash."
#Cycle through each file not yet hashed and calculate it's hash and store info in file
$BytesHashed = 0
$i = 0
foreach ($Obj in $FilesNotYetHashed)
{
#Progress bar
$i++
Write-Progress -Activity "Hashing files" -status "$([math]::Round($BytesHashed / 1GB)) of $([math]::Round($BytesToHash / 1GB))GB - Working on $i/$NumberOfFilesNotYetHashed - $($Obj.Name)" -percentComplete ($BytesHashed / $BytesToHash*100)
#Compute hash
$FileHash = (Get-FileHash -LiteralPath $Obj.FullName -Algorithm $Algorithm).Hash
#Build output file contents and output to file
$HashTable = @{
$Algorithm = [string]$FileHash
LastScanPassed = $null
LastScanDate = (Get-Date -Format 'yyyy-MM-dd_HH:mm:ss') #set current date so new files don't get scanned checked again soon.
}
$HashTable | ConvertTo-Json | Out-File -LiteralPath $Obj.HashFilePath #force allows overwrite existing read only files #### failes when path has square brackets unless you use literalpath
Write-Output "Stored '$FileHash' $Algorithm hash in '$($Obj.HashFilePath)'"
#Increment number of bytes that have been hashed for progress bar
$BytesHashed = $BytesHashed + $Obj.Length
}
#>
}
END
{
Write-Verbose "Completed hashing $([math]::Round($BytesHashed / 1GB)) GB in $i files"
}}
Later verify your previously hashed files with:
function Test-HashFiles
{
<#
.SYNOPSIS
Verify file hashes in directory.
.DESCRIPTION
This script searches the ScanPath for .MD5 or .SHA1 hash files. It makes sure the companion file exists. It then hashes the companion file and checks it against the previously stored hash; unless -Skiphash is used
Failed files will be checked each time.
.PARAMETER $ScanPath
The path that will be recursivly searched for files.
.PARAMETER $Algorithm
Specify whether to use MD5 or SHA1 algorithm to hash. Default is SHA1
.NOTES
Author: Michael Yamry
.EXAMPLE
$Results = Test-HashFiles -ScanPath "C:\test\" -SkipCheckDays -1 -Verbose
Verifyes hashes by recursivly searching for SHA1 files in the specified folder. -1 means it will force recheck all even if checked recently.
.EXAMPLE
$Orphaned = (Get-ChildItem -LiteralPath "\\test.local\DFS\Video\" -Recurse -Filter *.json).FullName | foreach {if (-not (Test-Path -LiteralPath $($_ -replace ".json")) ) {$_} }
$Orphaned | Remove-Item
Delete all orphaned hash files
.EXAMPLE
$Currupt = (Get-ChildItem -LiteralPath "\\test.local\DFS\Video" -Recurse -Filter *.json).FullName | foreach { if ( (Get-Content -LiteralPath $_ | ConvertFrom-Json).LastScanPassed -eq $false ) {$_ -replace ".json"} }
Find files that were marked as currupt
#>
[CmdletBinding()]
param (
[Parameter(Position=0, Mandatory=$true)]
[ValidateScript({Test-Path -LiteralPath $_ -PathType Container})]
[System.String]
$ScanPath = "\\test.local\DFS\Video",
#Skip scanning files that were scanned recently
[int]$SkipCheckDays = 60
)
Write-Verbose "Finding all '*.json' has files in '$ScanPath'."
$FoundFiles = Get-ChildItem -Path $ScanPath -Recurse -Filter *.json | Select-Object FullName, Name
#Count total number of files it will parse
$FileCount = ($FoundFiles | Measure-Object).Count
Write-Verbose "Found $FileCount .json files. Parsing through each getting source file properties and JSON contents."
#Loop through each file and build custom object with info such as name, length, and if has file exists already, etc
$ParsedFiles = foreach ($File in $FoundFiles)
{
$JSONContents = Get-Content -LiteralPath $File.FullName | ConvertFrom-Json
<# Example
{
"LastScanPassed": null,
"LastSCanDate": null,
"SHA1": "4C3883069DC34910ADB47DC41D2A837C93C40305"
} #>
#Retrive stored hash from file
if ($JSONContents.SHA1)
{
$Algorithm = "SHA1"
$StoredHash = $JSONContents.SHA1
} else {
if ($JSONContents.MD5)
{
$Algorithm = "MD5"
$StoredHash = $JSONContents.MD5
}
else
{
Write-Warning "Could not find SHA1 or MD5 properties in JSON file: $($HashFile.FullName)"
}
}
#find out if hash should be computed
if (-not $JSONContents.LastScanDate) #is the date emtpy
{
[bool]$ComputeHash = $true
}
else
{
$StoredDate = [datetime]::ParseExact($JSONContents.LastScanDate,'yyyy-MM-dd_HH:mm:ss',$null) #Convert string back to date
$TimeDifference = New-TimeSpan -Start $storedDate -End (Get-Date)
# has it been scanned recently?
if ( $TimeDifference.Days -gt $SkipCheckDays )
{
[bool]$ComputeHash = $true
} else {
[bool]$ComputeHash = $false
#Write-Verbose "[Skipped] '$($OutputObject.SourceFilePath)' File already checked $($TimeDifference.Days) day(s) ago."
}
}
#find out if source file exists and get size
try
{
$SourceFileLength = (Get-Item -LiteralPath $($File.FullName -replace ".json") -ErrorAction Stop).Length
$Exists = $true
}
catch
{
$Exists = $false
}
#make and output object
[PSCustomObject]@{
Name = $File.Name
FullName = $File.FullName
SourceFileName = ($File.Name -replace ".json")
SourceFileFullName = ($File.FullName -replace ".json")
SourceFileExists = $Exists
SourceFileLength = $SourceFileLength
LastScanPassed = $JSONContents.LastScanPassed
LastScanDate = $JSONContents.LastScanDate
Algorithm = $Algorithm
StoredHash = $StoredHash
ComputeHash = $ComputeHash
}
}
#Warn about currupt files
$ParsedFiles | Where-Object {$_.LastScanPassed -eq $false} | foreach { Write-Warning "File found currupt on last scan, will be rechecked: $($_.SourceFileFullName)"; Start-Sleep -Milliseconds 100}
#Warn about orphaned files
$ParsedFiles | Where-Object {$_.SourceFileExists -eq $false} | foreach { Write-Warning "Orphaned JSON file will be skipped: $($_.FullName)"}
#Show number of skipped files scanned recently
$SkippedCount = ($ParsedFiles | Where-Object {$_.ComputeHash -eq $false} | Measure-Object).Count
Write-Verbose "Skipping $SkippedCount files that were scanned in the last $SkipCheckDays day(s)."
#Select files that will be checked this run
$FilesToRun = $ParsedFiles | Where-Object {($_.ComputeHash -eq $true) -and ($_.SourceFileExists -eq $true)} #not filtering files that failed last. failed files will be checked each time.
Remove-Variable ParsedFiles
#Calculate quantity and size of this run
$BytesToHash = $FilesToRun | Measure-Object -Property SourceFileLength -Sum | Select-Object -ExpandProperty Sum
$QuantityFilesToRun = $FilesToRun | Measure-Object | Select-Object -ExpandProperty Count
Write-Verbose "$QuantityFilesToRun files to recompute totaling $([math]::Round($BytesToHash / 1GB)) GB."
$BytesHashed = 0
$i = 0
foreach ($CurrentFile in $FilesToRun)
{
#Progress bar
$i++
Write-Progress -Activity "Recomputing files" -Status "$([math]::Round($BytesHashed / 1GB)) of $([math]::Round($BytesToHash / 1GB))GB - Working on $i/$QuantityFilesToRun - $($CurrentFile.SourceFileName)" -PercentComplete ($BytesHashed / $BytesToHash*100)
#Compute hash of curent file
$TestedFileHash = Get-FileHash -LiteralPath $CurrentFile.SourceFileFullName -Algorithm $CurrentFile.Algorithm | Select-Object -ExpandProperty Hash
#Build object to be put back into JSON file
$Contents = @{}
$Contents.LastScanDate = (Get-Date -Format 'yyyy-MM-dd_HH:mm:ss')
#Compare hashes
if ($TestedFileHash -eq $CurrentFile.StoredHash)
{
Write-Verbose "[Verified] $($CurrentFile.SourceFileFullName)"
$Contents.LastScanPassed = $true
}
else
{
Write-Warning "Stored hash '$StoredHash' does not match current hash '$TestedFileHash' for: $($OutputObject.SourceFilePath)"
$Contents.LastScanPassed = $false
}
#Increment number of bytes that have been hashed for progress bar
$BytesHashed = $BytesHashed + $CurrentFile.SourceFileLength
#Output new JSON file
$Contents.($CurrentFile.Algorithm) = $CurrentFile.StoredHash
$JSONContents = New-Object –TypeName PSObject -Property $Contents
$JSONContents | ConvertTo-Json | Out-File -LiteralPath $CurrentFile.FullName -Force
Remove-Variable -Name JSONContents, Contents
}
Write-Verbose "Completed all operations."}
I’d recommend using the above functions in a script such as the one below. Set it to run weekly or something using a scheduled task.
Write-Verbose “Running script: $PSCommandPath” -Verbose
Out-HashFiles -ScanPath “\test.local\DFS\Video” -Algorithm SHA1 -LargerThan 100MB -Depth 5 -Verbose
Test-HashFiles -ScanPath “\test.local\DFS\Video” -SkipCheckDays 60 -Verbose
Write-Verbose “End of script: $PSCommandPath” -Verbose
Start-Sleep -Seconds 20
