Hash a whole folder and spot what changed

To hash a folder, you hash every file in it and save the results to a manifest: a plain list with one line per file, its SHA-256 and its path. Re-hash the folder later and compare against that list, and you can name every file that was changed, added or removed since.

It is the same check you would run on a single download, repeated across a whole tree of files. If you have not hashed a single file before, the checksums guide explains the idea in a few paragraphs, and the walkthrough on verifying a single download against its published SHA-256 shows the one-file version step by step. When a line in the manifest fails, the guide to why two hashes disagree lists the usual causes.

You need

• The folder you want to record.
• A place outside that folder to keep the manifest.
• PowerShell on Windows, or Terminal on a Mac or Linux.

Make a hash manifest on Windows

PowerShell can list every file under a folder and hash each one in a single pipeline. Get-ChildItem with -Recurse walks every subfolder, and -File leaves out the folders themselves. Each file is passed to Get-FileHash, whose output, per Microsoft's Get-FileHash reference, holds the algorithm, the hash and the file's path.

Open PowerShell in the folder you want to record, then run:

Get-ChildItem -Path . -Recurse -File | Get-FileHash -Algorithm SHA256 | Export-Csv -Path ..\manifest.csv -NoTypeInformation

This writes manifest.csv to the parent folder, so the manifest is not inside the set of files it describes. Open it in any spreadsheet or text editor to see one row per file.

Get-FileHash records full paths. Run the later check from the same location, or the paths will not line up. For checking one file at a time, see the guide to checking a file hash on Windows.

On Mac and Linux

The standard tools build the same kind of manifest, in the format that sha256sum and shasum can check directly. On Linux, from inside the folder:

find . -type f -exec sha256sum {} + | sort -k 2 > ../manifest.sha256

On a Mac, use shasum -a 256 in place of sha256sum:

find . -type f -exec shasum -a 256 {} + | sort -k 2 > ../manifest.sha256

The -a 256 matters. The shasum documentation lists SHA-1 as the default, so leaving it out gives you a SHA-1 manifest. Sorting by path makes two manifests easy to compare later.

Here is a manifest for a small test folder, made on Ubuntu 22.04:

444e0fffbd825e9610ff5b199485707a0c895339ae80c15cc8a8aee41b106fda  ./docs/notes.md
123de939f995d0d58757cfcf6f19a70263e3d8b4778b7e4b887f2a4a7bc02304  ./docs/report.txt
00df8129db2beb34f897239d0cfb0d6716d3c411a199eb84df6f7388b58425ef  ./photos/IMG_0001.jpg
17866d2fc39247563f006e55ad372c5d2b73dc44217540db164f439fcaf403db  ./photos/IMG_0002.jpg

Re-check later and spot changes

After making that manifest, one file was edited, one was deleted and one was added. Running the check from inside the same folder shows the first two straight away:

sha256sum -c ../manifest.sha256

./docs/notes.md: OK
./docs/report.txt: FAILED
./photos/IMG_0001.jpg: OK
sha256sum: ./photos/IMG_0002.jpg: No such file or directory
./photos/IMG_0002.jpg: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read
sha256sum: WARNING: 1 computed checksum did NOT match

FAILED means the file is there but its contents changed. FAILED open or read means it is gone. The GNU Coreutils manual notes that the command exits with a nonzero status in either case, and that --quiet hides the OK lines so only problems are listed. On a Mac, shasum -a 256 -c ../manifest.sha256 gives the same report.

The check only reads files named in the manifest, so it cannot see the new file. To catch additions too, make a second manifest the same way and compare the two:

find . -type f -exec sha256sum {} + | sort -k 2 > ../manifest-new.sha256
diff ../manifest.sha256 ../manifest-new.sha256

0a1
> 7aa7a5359173d05b63cfd682e3c38487f3cb4f7f1d60659fe59fab1505977d4c  ./docs/extra.txt
2c3
< 123de939f995d0d58757cfcf6f19a70263e3d8b4778b7e4b887f2a4a7bc02304  ./docs/report.txt
---
> d0fc64826500d769d19c5d6348ab7a6abeebe43e98d90348b577411acdbbace9  ./docs/report.txt
4d4
< 17866d2fc39247563f006e55ad372c5d2b73dc44217540db164f439fcaf403db  ./photos/IMG_0002.jpg

Lines starting with > are only in the new manifest, so extra.txt was added. Lines starting with < are only in the old one, so IMG_0002.jpg was removed. A path that appears on both sides with different hashes, like report.txt, was changed.

On Windows, load the old manifest and compare it with a fresh scan. Compare-Object lists every row that differs:

$before = Import-Csv ..\manifest.csv
$after = Get-ChildItem -Path . -Recurse -File | Get-FileHash -Algorithm SHA256
Compare-Object -ReferenceObject $before -DifferenceObject $after -Property Path, Hash

Rows marked <= exist only in the old manifest and rows marked => only in the new scan. A changed file appears twice, once each way, with the same path and two different hashes.

Common problems

The manifest lists itself. If you save the manifest inside the folder you are hashing, the next scan hashes the manifest too, and it will always show as changed. Save it one level up, as in the commands above, or somewhere else entirely.

Every file shows as changed on Windows. Check that you ran the second scan from the same folder as the first. Get-FileHash stores full paths, so a folder that moved or was opened through a different drive letter produces different paths for the same files.

The scan takes a long time. Hashing reads every byte of every file, so a large photo or video library takes as long as reading it from disk. Run the first manifest once, then re-check only when you need to, for example after copying the folder to a new drive.

Hidden and system files appear in one scan but not another. find includes hidden files on Mac and Linux. On Windows, add -Force to Get-ChildItem if you want hidden files included, and use the same choice every time.

File names with unusual characters. Paths with spaces work in both formats. Names with line breaks or other control characters are rare, but they can confuse sort and diff; rename such files before you make the manifest.

What a manifest proves

A manifest that still checks out proves that every listed file is byte for byte what it was when the manifest was made. That is useful for backups, for archives you copy between drives, for a game or mod folder you want to keep pristine, and for evidence you may need to hand over later.

It has the same limits as any checksum. It does not prove when the manifest was made, and anyone who can change the files and the manifest together can make them agree. Keep the manifest somewhere separate, and hash the manifest file itself, so that a single 64-character value stands for the whole folder.

The same idea in content credentials

A content credential on an image works like a one-file manifest with a signature on top: it records a hash of the content, and the signature shows who made the record. For your own work, you can get part of the way there with what is on this page. Hash your drafts as you go, keep the manifest, and add a trusted timestamp so the record has a date nobody can quietly change. The guide to hashing and timestamping your drafts walks through that routine step by step.

Sources

1. Microsoft Learn, Get-ChildItem
2. Microsoft Learn, Get-FileHash
3. GNU Coreutils manual, cksum common options
4. Perl documentation, shasum

Questions

• Can I get a single hash for a whole folder?+

  Yes, by hashing the manifest file itself once it is made. That one value then stands for every file hash in the list, though it cannot tell you which file changed.

• Does a folder manifest notice renamed files?+

  Yes. A renamed file shows up as one path removed and one path added, with the same hash on both lines.

• Where should I keep the manifest?+

  Outside the folder you are hashing, and ideally on a different disk or account too. A manifest stored next to the files can be changed by whoever changes the files.

• Which algorithm should a manifest use?+

  SHA-256. It is fast enough for large folders on current hardware and has no known practical collisions.