md5deep - Programs to compute MD5, SHA-1, or SHA-256 message digests on files

Distribution: Fedora 25
Repository: CERT Forensics Tools x86_64
Package name: md5deep
Package version: 4.4
Package release: 1.fc25
Package architecture: x86_64
Package type: rpm
Installed size: 15.02 MB
Download size: 3.83 MB
Official Mirror:
md5deep is a cross-platform set of programs to compute MD5, SHA-1, or SHA-256 message digests on an arbitrary number of files. The programs run on Windows, Linux, *BSD, OS X, Solaris, and should run on most other platforms. md5deep is similar to the md5sum program found in the GNU Coreutils package, but has the following additional features: * Recursive operation - md5deep is able to recursive examine an entire directory tree. That is, compute the MD5 for every file in a directory and for every file in every subdirectory. * Time estimation - md5deep can produce a time estimate when it's processing very large files. * Comparison mode - md5deep can accept a list of known hashes and compare them to a set of input files. The program can display either those input files that match the list of known hashes or those that do not match. Hashes sets can be drawn from the National Software Reference Library, iLook Investigator, Hashkeeper, or md5sum. Users are welcome to add functionality to read other formats too! * File type mode - md5deep can process only files of a certain type, such as regular files, block devices, etc.



  • md5deep = 4.4-1.fc25
  • md5deep(x86-64) = 4.4-1.fc25


    Install Howto

    1. Download cert-forensics-tools-release-25 rpm:
    2. Install cert-forensics-tools-release-25 rpm:
      # rpm -Uvh cert-forensics-tools-release*rpm
    3. Install md5deep rpm package:
      # dnf --enablerepo=forensics install md5deep


    • /usr/bin/hashdeep
    • /usr/bin/md5deep
    • /usr/bin/sha1deep
    • /usr/bin/sha256deep
    • /usr/bin/tigerdeep
    • /usr/bin/whirlpooldeep
    • /usr/share/doc/md5deep/AUTHORS
    • /usr/share/doc/md5deep/COPYING
    • /usr/share/doc/md5deep/ChangeLog
    • /usr/share/doc/md5deep/INSTALL
    • /usr/share/doc/md5deep/NEWS
    • /usr/share/doc/md5deep/README
    • /usr/share/doc/md5deep/TODO
    • /usr/share/man/man1/hashdeep.1.gz
    • /usr/share/man/man1/md5deep.1.gz
    • /usr/share/man/man1/sha1deep.1.gz
    • /usr/share/man/man1/sha256deep.1.gz
    • /usr/share/man/man1/tigerdeep.1.gz
    • /usr/share/man/man1/whirlpooldeep.1.gz


    2014-01-01 - Lawrence Rogers <> 4.4-1 * Release 4.4-1 * src/dig.cpp: Support deduplication reparse points, issue 307. * src/multihash.cpp (hash_context_obj::multihash_finalize): removed old code that was commented out. * src/dig.cpp: Fixed issue 301 re: removing double dots from path * Removed sha3deep target * hashlist.cpp: Fixes problem with known files with commas in filename. * Added patch from dago to check for MAP_FILE * src/dig.cpp: Experimental change to parse single instance storage (SIS) junction points. * src/hashlist.cpp: Added experimental mode for case insensitive matching. Also changes in main.cpp, main.h, and display.cpp * src/ Added sha3deep * src/main.h: Added SHA3 defines * src/main.cpp: Added SHA3 code * src/common.h: Increased max size of context structure for SHA-3 * man/hashdeep.1: Clarified Unicode statements * main.cpp: Converting break statements which fall through to consistent style. * main.cpp: Added checks in hashdeep against user errors on command line * dig.cpp: Adding specific message regarding SIS reparse points. * blake: Removed code which won't be used * Uncommented check for big endian systems. * src/threadpool.cpp: Renamed ERR function to avoid conflicts on SunOS and derivates. * man/md5deep.1, hashdeep.1: Typos

    2012-10-24 - Lawrence Rogers <> 4.3-1 * Release 4.3-1 Bug Fixes Fixed check for endian-ness, affecting hash generation on big-endian platforms. Fixed minor bugs related to OpenSolaris.

    2012-06-11 - Lawrence Rogers <> 4.2-1 * Release 4.2-1 Bug Fixes Fixed padding in Tiger hashes for large files

    2012-02-14 - <> 4.1-1 * Release 4.1-1 New Features Added expert mode option to parse Windows PE files Bug Fixes Fixed junction point handling on Win32

    2012-01-27 - <> 4.0.1-1 * Release 4.0.1-1 * Bug Fixes Fixed hang on DFXML generation on Win32 Fixed incorrect hashes via stdin on Win32 Fixed "Too many open files" error on OS X Doc files in Win32 have been corrected.

    2012-01-06 - <> 4.0.0-1 * Release 4.0.0-1 * New Features Rewrote most of the program in C++. Enabled multiprocessor support on all platforms. Removed ten character limit on file size mode * Bug Fixes Too numerous to count!

    2011-07-26 - <> 3.9.2-1 * Release 3.9.2-1 New Features Added a warning message when running 32-bit versions of the programs on a 64-bit system. Bug Fixes Fixed a cosmetic bug in the hashdeep header.

    2011-05-31 - <> 3.9.1-1 * Release 3.9.1-1 New Features Added -f mode to get the list of input files from a file on the disk. Added 64-bit executables for Windows. Bug Fixes Fixed a critical bug regarding hashdeep's ability to compute correct hashes on standard input. Fixed a cosmetic bug regarding the error messages for piecewise mode. Fixed a cosmetic bugs regarding processing standard input in piecewise mode. Fixed a bug regarding processing known hash files which have parenthesis in the filename. Clarified documentation regarding multipliers in piecewise mode. They are IEC multipliers, or blocks of 1,024. Side note: also spelled 'multipliers' correctly.

    2011-04-21 - <> 3.9-1 * Release 3.9-1 New Features Bug Fixes Fixed a critical bug in hashdeep regarding processing standard input Added -f mode to get the list of input files from

    2011-04-15 - <> 3.8-1 * Release 3.8-1 New Features Added -f mode to get the list of input files froma file on the disk. Added 64-bit executables for Windows. Bug Fixes Fixed a cosmetic bug regarding the error messages for piecewise mode.