Verify downloaded iso integrity with md5sum or sha1sum

[bodhi.zazen]

md5sum and sha1sum are utilities to check the integrity of a file, usually a downloaded iso

In this example I will use "Ubuntu.iso" and a file "groups", but this works with any file.

Note: This how is performed entirely in a terminal (CLI). No GUI.

GUI Tool ~ Windows/Mac/Linux versions : md5 file check (Penguin byte)

EDIT: The section on multiple files was added at the suggestion of 655 (Thanks 655).

md5sum

Create a *.md5 file:

md5sum Ubuntu.iso > Ubuntu.iso.md5

Note: Do not use this to verify a downloaded iso or file.
This is an example of how to create a *.md5 on a file you trust. Give this to others to verify the integrity of a file or iso you authored.
See "How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files" section below.

Verify md5sum of a file or iso:

md5sum -c Ubuntu.iso.md5

sha1sum

Create a *.sha1 file:

sha1sum Ubuntu.iso > Ubuntu.iso.sha1

Note: Do not use this to verify a downloaded iso or file.
This is an example of how to create a *.sha1 on a file you trust. Give this to others to verify the integrity of a file or iso you authored.
See "How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files" section below.

Verify sha1sum of a file or iso:

sha1sum -c Ubuntu.iso.sha1

Format of *.md5 and *.sha1 files

Format of a *.md5 or *.sha1:

<m5d> Ubuntu.iso <sha1> Ubuntu.iso

Note: There are 2 spaces between the sum and iso

Sample *.md5 and *.sha1 file contents:

groups.md5 (file = groups)

b2d57f96eba473ce6e8f345e2ae7f149 groups

groups.sha1 (file = groups)

1cab92940e459d872211c7d1a195520d3062029d groups

How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files

Note:

1. The iso and iso.md5 or iso.sha1 must both be in the same directory.
2. The directory containing these files must be your current directory.

For example: If your iso and iso.md5 were downloaded to your Desktop:

cd ~/Desktop
md5sum -c iso.md5

Step-by-step instructions

Create an *.iso.md5 or *.iso.sha1 file (to check integrity):

1. Get the md5sum or sha1sum from the download site (download the iso.md5/iso.sha1 or create an iso.md5/iso.sha1 as below).
2. From the CLI:
   

   echo "<paste_md5_sum_here>  Ubuntu.iso" > Ubuntu.iso.md5sum
   
   OR
   
   echo "<paste_sha1_sum_here>  Ubuntu.iso" > Ubuntu.iso.sha1sum

3. Or, if you prefer, use a graphical editor (gedit/kate/nano/vim):

   • Open an editor
     <paste_md5_sum_here> Ubuntu.iso
     Save as Ubuntu.iso.md5
   • Open an editor
     <paste_sha1_sum_here> Ubuntu.iso
     Save as Ubuntu.iso.sha1

4. Verify the integrity as above, use the md5sum and sha1sum from the download site.
5. Multiple files. To chesk multiple files use multiple entries in your *.md5 or *.sha1 (see bleow). ALL FILES TO BE CHECKED AND THE *.md5 or *.sha1 MUST BE IN THE SAME DIRECTORY.

Examples (CLI)

Examples using a file groups:

md5: bodhi@Arch:~$md5sum groups > groups.md5sum bodhi@Arch:~$cat groups.md5sum b2d57f96eba473ce6e8f345e2ae7f149 groups bodhi@Arch:~$md5sum -c groups.md5sum groups: OK bodhi@Arch:~$ sha1: bodhi@Arch:~$sha1sum groups > groups.sha1 bodhi@Arch:~$cat groups.sha1 1cab92940e459d872211c7d1a195520d3062029d groups bodhi@Arch:~$sha1sum -c groups.sha1 groups: OK bodhi@Arch:~$

Multiple files
This will check any ubuntu*.iso in the current directory.

You will get an error message if the file does not exist, the 2>/dev/null redirects the error message.

md5sum -c MD5SUMS 2>/dev/null

File name = MD5SUMS (Note: Unlike other OS, in Linux the file with your sums does not need to end in .md5 or .sha1.

b9a5be3a5858ade278d664d41310a4ab ubuntu-6.06.1-alternate-amd64.iso 6cb8582aa5615ed4616165743a0868d7 ubuntu-6.06.1-alternate-i386.iso 0b5b3df02da3d9ed6f4ac482cf541f04 ubuntu-6.06.1-alternate-powerpc.iso 50e3912c555f98f7bca56b2a0200b205 ubuntu-6.06.1-desktop-amd64.iso fb3af44c21f1f68cc25fda7edb8c1bd3 ubuntu-6.06.1-desktop-i386.iso 502911770ad173dbe82c698379ed7d11 ubuntu-6.06.1-desktop-powerpc.iso 8254b0f3696ed17c52a2cb59c9ebd2cc ubuntu-6.06.1-server-amd64.iso 5ad76d8b380ab5be713e5daa9ea84475 ubuntu-6.06.1-server-i386.iso 6d1c3b5cb41661365b3db5cf12bb2836 ubuntu-6.06.1-server-powerpc.iso 2ccc1ec608040e6aac8913a016c31bed ubuntu-6.06.1-server-sparc.iso

Check the md5sum or sha1sum after burning a CD

K3b will show the md5sum of the iso and check (show) the md5sum of the burned CD/DVD automatically (which is part of the reason I would advise K3b over other options).

From the CLI:
Note: Some consider this method to be unreliable.

1. Put the disk into your CD/DVD drive.
2. Mount the CD/DVD if your system does not automount the CD/DVD.
3. Address the CD/DVD by /dev/hdxy NOT /dev/cdrom.
4. ie /dev/hdc

Example
Note: On my box my CD is /dev/hda

bodhi@Arch:~$md5sum /dev/hda a3c9b003d9bb5c7e7fc3645d43b9b8ad /dev/hda bodhi@Arch:~$sha1sum /dev/hda e2882ef99b8079a10d6567493a7ac6e8e89d6a42 /dev/hda bodhi@Arch:~$

Note: This takes some time and you will need to confirm the md5sum visually (no auto check).

Automation
This involves some fancy CLI footwork:
md5sum:

md5sum /dev/hda > ./test && diff ./test /home/bodhi/MyDownloads/fluxbuntu.iso.md5 && rm -f ./test

Returns:

< a3c9b003d9bb5c7e7fc3645d43b9b8ad /dev/hda --- > a3c9b003d9bb5c7e7fc3645d43b9b8ad Fluxbuntu.iso bodhi@Arch:~$

sha1sum

sha1sum /dev/hda > ./test && diff ./test /home/bodhi/MyDownloads/fluxbuntu.iso.sha1 && rm -f ./test

Returns:

< e2882ef99b8079a10d6567493a7ac6e8e89d6a42 /dev/hda --- > e2882ef99b8079a10d6567493a7ac6e8e89d6a42 Fluxbuntu.iso bodhi@Arch:~$

Which will at least line up the md5/sha1 sums.
Note: You must supply the proper path to the iso.md5 and iso.sha1.



Windows users
Windows md5sum checker (Free, opensource): winMd5Sum

Windows sha1sum checker (Free, opensource): sha1sum
Note: This is run from the windows command line, no gui. See link for instructions.


Download with confidence

bodhi.zazen

[DC@DR]

Great HOWTO, it's clear and easy-to-follow, many thanks

[655]

Reviving a somewhat old thread here, but...
It was very instructive and to-the-point, thank you.

My one question is, is there a way to run this command on a batch of files at once, with separate .md5 files being generated for each file? Or to have it work recursively in several directories?

Maybe I need a separate utility to do this

[bodhi.zazen]

Originally Posted by 655 Reviving a somewhat old thread here, but... It was very instructive and to-the-point, thank you. My one question is, is there a way to run this command on a batch of files at once, with separate .md5 files being generated for each file? Or to have it work recursively in several directories? Maybe I need a separate utility to do this

655: Thank you fro taking the time to reply.

Absolutely.

The files must to be checked must all be in the same directory, and the *.md5 must also be in the same directory.

Example:

File name = MD5SUMS

b9a5be3a5858ade278d664d41310a4ab ubuntu-6.06.1-alternate-amd64.iso 6cb8582aa5615ed4616165743a0868d7 ubuntu-6.06.1-alternate-i386.iso 0b5b3df02da3d9ed6f4ac482cf541f04 ubuntu-6.06.1-alternate-powerpc.iso 50e3912c555f98f7bca56b2a0200b205 ubuntu-6.06.1-desktop-amd64.iso fb3af44c21f1f68cc25fda7edb8c1bd3 ubuntu-6.06.1-desktop-i386.iso 502911770ad173dbe82c698379ed7d11 ubuntu-6.06.1-desktop-powerpc.iso 8254b0f3696ed17c52a2cb59c9ebd2cc ubuntu-6.06.1-server-amd64.iso 5ad76d8b380ab5be713e5daa9ea84475 ubuntu-6.06.1-server-i386.iso 6d1c3b5cb41661365b3db5cf12bb2836 ubuntu-6.06.1-server-powerpc.iso 2ccc1ec608040e6aac8913a016c31bed ubuntu-6.06.1-server-sparc.iso

To check multiple 5mdsums:

md5sum -c MD5SUMS

This will check any ubuntu*.iso in the current directory.

You will get an error message if the file does not exist..

So:

md5sum -c MD5SUMS 2>/dev/null

Redirects all those error messages.

I will add this to the how-to...

HTH

[655]

bodhi.zazen:

Thank you for more tips
I had a more strange and complicated scenario in mind, but I will try the limits of this method for now.

[buuntuu!]

hi everyone, got a shell-newbie-question on
"How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files"

i downloaded the dapper-iso-file and now i'm stuck trying to check out the md5sum.

i followed the instructions (by the way: thanks to all you patient cracks out there who help us little hatchlings) step 1. to 3.
i managed to create the Ubuntu.iso.md5sum (how fascinating, a command line )
both the Ubuntu.iso.md5sum and the ubuntu-6.06.1-desktop-i386.iso are on the desktop

but i get stuck at step 4. i'm not sure what to type!
this is my cli:
mat@mat-laptop:~/Desktop$ md5sum -c iso.md5
md5sum: iso.md5: No such file or directory

so i gave it another try:
mat@mat-laptop:~/Desktop$ md5sum -c ubuntu.6.06.1-desktop-i386.iso.md5sum
md5sum: ubuntu.6.06.1-desktop-i386.iso.md5sum: No such file or directory

and another one:
mat@mat-laptop:~/Desktop$ md5sum -c ubuntu-6.06.1-desktop-i386.md5
md5sum: ubuntu-6.06.1-desktop-i386.md5: No such file or directory

well, obviously i missed something...
damn bill for making me so gui-dependent
can anyone help?
regards, buuntuu

[bodhi.zazen]

Your active or "working directory" needs to be that in which the .iso and md5 are located.

In your case that is ~/Desktop (~ is short hand for /home/user_name).

In the terminal:

cd ~/Desktop
md5sum -c Ubuntu.iso.md5sum

Should do the trick !

I hope you got the Ubuntu.iso.md5sum from ubuntu.

Ubuntu distributes the md5sums as a file "MD5SUMS"

Here is the link: MD5SUMS

Open and save the file to you desktop as MD5SUMS .

Then :

cd ~/Desktop
md5sum -c MD5SUMS

You will get some error messages about missing ubuntu iso's, but that is OK....

[buuntuu!]

thanks for the fast reply
my md5sums were from where you indicated...
however, the reply remains the same:
md5sum: Ubuntu.iso.md5sum: No such file or directory

well, you can't understand everything right away.
in the end i did it the old-fashioned-way...good idea not deleting windows right away still do need my carrying wheels!

[bodhi.zazen]

Can you post the output of:

ls ~/Desktop

[swegner]

Thanks for the tutorial. Note though, that you mention the command to check sha1 sums as

sha1 -c <sha1sum-file>

when in fact it should be

sha1sum -c <sha1sum-file>

I appears that you've corrected it in your examples, but I just wanted to point it out for anybody that missed it. I'm testing on Ubuntu Intrepid 8.10.