Verify downloaded iso integrity with md5sum or sha1sum

[bodhi.zazen]

md5sum and sha1sum are utilities to check the integrity of a file, usually a downloaded iso

In this example I will use "Ubuntu.iso" and a file "groups", but this works with any file.

Note: This how is performed entirely in a terminal (CLI). No GUI.

GUI Tool ~ Windows/Mac/Linux versions : md5 file check (Penguin byte)

EDIT: The section on multiple files was added at the suggestion of 655 (Thanks 655).

md5sum

Create a *.md5 file:

md5sum Ubuntu.iso > Ubuntu.iso.md5

Note: Do not use this to verify a downloaded iso or file.
This is an example of how to create a *.md5 on a file you trust. Give this to others to verify the integrity of a file or iso you authored.
See "How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files" section below.

Verify md5sum of a file or iso:

md5sum -c Ubuntu.iso.md5

sha1sum

Create a *.sha1 file:

sha1sum Ubuntu.iso > Ubuntu.iso.sha1

Note: Do not use this to verify a downloaded iso or file.
This is an example of how to create a *.sha1 on a file you trust. Give this to others to verify the integrity of a file or iso you authored.
See "How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files" section below.

Verify sha1sum of a file or iso:

sha1sum -c Ubuntu.iso.sha1

Format of *.md5 and *.sha1 files

Format of a *.md5 or *.sha1:

<m5d> Ubuntu.iso <sha1> Ubuntu.iso

Note: There are 2 spaces between the sum and iso

Sample *.md5 and *.sha1 file contents:

groups.md5 (file = groups)

b2d57f96eba473ce6e8f345e2ae7f149 groups

groups.sha1 (file = groups)

1cab92940e459d872211c7d1a195520d3062029d groups

How to use md5sum and sha1sum files to verify integrity of downloaded iso images or files

Note:

1. The iso and iso.md5 or iso.sha1 must both be in the same directory.
2. The directory containing these files must be your current directory.

For example: If your iso and iso.md5 were downloaded to your Desktop:

cd ~/Desktop
md5sum -c iso.md5

Step-by-step instructions

Create an *.iso.md5 or *.iso.sha1 file (to check integrity):

1. Get the md5sum or sha1sum from the download site (download the iso.md5/iso.sha1 or create an iso.md5/iso.sha1 as below).
2. From the CLI:
   

   echo "<paste_md5_sum_here>  Ubuntu.iso" > Ubuntu.iso.md5sum
   
   OR
   
   echo "<paste_sha1_sum_here>  Ubuntu.iso" > Ubuntu.iso.sha1sum

3. Or, if you prefer, use a graphical editor (gedit/kate/nano/vim):

   • Open an editor
     <paste_md5_sum_here> Ubuntu.iso
     Save as Ubuntu.iso.md5
   • Open an editor
     <paste_sha1_sum_here> Ubuntu.iso
     Save as Ubuntu.iso.sha1

4. Verify the integrity as above, use the md5sum and sha1sum from the download site.
5. Multiple files. To chesk multiple files use multiple entries in your *.md5 or *.sha1 (see bleow). ALL FILES TO BE CHECKED AND THE *.md5 or *.sha1 MUST BE IN THE SAME DIRECTORY.

Examples (CLI)

Examples using a file groups:

md5: bodhi@Arch:~$md5sum groups > groups.md5sum bodhi@Arch:~$cat groups.md5sum b2d57f96eba473ce6e8f345e2ae7f149 groups bodhi@Arch:~$md5sum -c groups.md5sum groups: OK bodhi@Arch:~$ sha1: bodhi@Arch:~$sha1sum groups > groups.sha1 bodhi@Arch:~$cat groups.sha1 1cab92940e459d872211c7d1a195520d3062029d groups bodhi@Arch:~$sha1sum -c groups.sha1 groups: OK bodhi@Arch:~$

Multiple files
This will check any ubuntu*.iso in the current directory.

You will get an error message if the file does not exist, the 2>/dev/null redirects the error message.

md5sum -c MD5SUMS 2>/dev/null

File name = MD5SUMS (Note: Unlike other OS, in Linux the file with your sums does not need to end in .md5 or .sha1.

b9a5be3a5858ade278d664d41310a4ab ubuntu-6.06.1-alternate-amd64.iso 6cb8582aa5615ed4616165743a0868d7 ubuntu-6.06.1-alternate-i386.iso 0b5b3df02da3d9ed6f4ac482cf541f04 ubuntu-6.06.1-alternate-powerpc.iso 50e3912c555f98f7bca56b2a0200b205 ubuntu-6.06.1-desktop-amd64.iso fb3af44c21f1f68cc25fda7edb8c1bd3 ubuntu-6.06.1-desktop-i386.iso 502911770ad173dbe82c698379ed7d11 ubuntu-6.06.1-desktop-powerpc.iso 8254b0f3696ed17c52a2cb59c9ebd2cc ubuntu-6.06.1-server-amd64.iso 5ad76d8b380ab5be713e5daa9ea84475 ubuntu-6.06.1-server-i386.iso 6d1c3b5cb41661365b3db5cf12bb2836 ubuntu-6.06.1-server-powerpc.iso 2ccc1ec608040e6aac8913a016c31bed ubuntu-6.06.1-server-sparc.iso

Check the md5sum or sha1sum after burning a CD

K3b will show the md5sum of the iso and check (show) the md5sum of the burned CD/DVD automatically (which is part of the reason I would advise K3b over other options).

From the CLI:
Note: Some consider this method to be unreliable.

1. Put the disk into your CD/DVD drive.
2. Mount the CD/DVD if your system does not automount the CD/DVD.
3. Address the CD/DVD by /dev/hdxy NOT /dev/cdrom.
4. ie /dev/hdc

Example
Note: On my box my CD is /dev/hda

bodhi@Arch:~$md5sum /dev/hda a3c9b003d9bb5c7e7fc3645d43b9b8ad /dev/hda bodhi@Arch:~$sha1sum /dev/hda e2882ef99b8079a10d6567493a7ac6e8e89d6a42 /dev/hda bodhi@Arch:~$

Note: This takes some time and you will need to confirm the md5sum visually (no auto check).

Automation
This involves some fancy CLI footwork:
md5sum:

md5sum /dev/hda > ./test && diff ./test /home/bodhi/MyDownloads/fluxbuntu.iso.md5 && rm -f ./test

Returns:

< a3c9b003d9bb5c7e7fc3645d43b9b8ad /dev/hda --- > a3c9b003d9bb5c7e7fc3645d43b9b8ad Fluxbuntu.iso bodhi@Arch:~$

sha1sum

sha1sum /dev/hda > ./test && diff ./test /home/bodhi/MyDownloads/fluxbuntu.iso.sha1 && rm -f ./test

Returns:

< e2882ef99b8079a10d6567493a7ac6e8e89d6a42 /dev/hda --- > e2882ef99b8079a10d6567493a7ac6e8e89d6a42 Fluxbuntu.iso bodhi@Arch:~$

Which will at least line up the md5/sha1 sums.
Note: You must supply the proper path to the iso.md5 and iso.sha1.



Windows users
Windows md5sum checker (Free, opensource): winMd5Sum

Windows sha1sum checker (Free, opensource): sha1sum
Note: This is run from the windows command line, no gui. See link for instructions.


Download with confidence

bodhi.zazen