• Translate:

The Hash Tool

The Hash Tool

As stated in Wikipedia,

“A hash function is any function that can be used to map data of arbitrary size to data of fixed size. The values returned by a hash function are called hash values, hash codes, digests, or simply hashes.”

The goal, here, is not to explain the concept of hashes. For that, other sources like the Wikipedia page will be more helpful. In this page, I explain how to use FileVoyager to compute hashes.

Note: The hash library used in FileVoyager is the Delphi Encryption Compendium (DEC)

Selecting one or more file for the hashing

When in the main form of FileVoyager select the file(s) you want to get the hash from.
If you want to get the hash(es) of one file, you can simply focus that file.
If you want to get the hashes of more than one file, you have to select the files.
For documentation on how to select items, see items selection and deselection.

Launching the Hash Tool

When the file selection is made, the Hash Tool can be open by different means.

  • If you are using the Ribbon interface, open the Tools tab of the Ribbon, and click the Hash Tool button (under the red rectangle in the image below)

ficut Tools Run dialog box Display properties System nstalled software Date and time properties Embedded Viewer External Viewer Viewers External' Viewers Disk properties Disk Compare listed - paths Compare items Compare and Sync Tool Hash

  • If you are using the Classic UI, you can click the Hash Tool button (under the red rectangle in the image below)…
    …or by the menu Tools\Hash Tool

  • And finally, you can also open the Hash Tool by opening the context menu and clicking on “Hashes and VirusTotal” entry

Configuring the Hash Tool

When the Hash Tool appears, you can see the following elements:

  1. The list of the items for whom you need a Hash computation
  2. The Buttons to manage the above list. It’s quite self explanatory:
    1. “Add files” allows to add a file in the list
    2. “Add folder” allows to add a folder into the list
    3. “Remove selected items” will remove from the list the, well, selected items…
  3. “Recursive (…)”.
    1. When not checked, only the files directly under the folders will be computed, and not the content of the subfolders.
    2. When checked, every file inside the folders, whatever the level of deepness, will be computed.
  4. “Check with VirusTotal”. When checked, FileVoyager will automatically check the file hashes against the VirusTotal.com database. To see how to use this integration with VirusTotal.com, check the dedicated documentation: Check for malware using VirusTotal.com.
  5. Algorithms. In this collection of check boxes you can select the various algorithms you want to be computed.
  6. Compute hashes. When satisfied with the selection of files and folders in (1), and with the parameters from (3) and (4), clicking this button will execute the computation of the hashes.

Computation of the hashes

When you start the computation of hashes and have selected the “Check with VirusTotal” checkbox, this window may appear
This is the windows where you can put your own VirusTotal user key.
Read the documentation on how to Check for malware using VirusTotal.com to know more about it.

Once you get rid of that window, the computation starts and this window below is displayed.

The file hashes are computed in 3 steps: Queuing – Processing – Ready

  1. The files have been processed. They are recognizable because their hash fields contain hashes values
  2. The file is being processed. A bar is visible next to the filename and shows the progress of the computing
  3. The files are queued and not processed yet (the hashes columns are empty)

The results page

The layout here is pretty basic. A table fills the form with a few commands below it.

  1. The 1st column of the table is the filename.
    An expand button appears on the left of the file icon. When the button is expanded, it just shows another view of the resulting hashes.
  2. The 2nd column is the filepath
  3. The 3rd column contains the VirusTotal.com score. Read Check for malware using VirusTotal.com for more information.
    This column is not shown if the “Check with VirusTotal” box was not checked in the configuration screen.
  4. The other columns are dynamically created depending on the algorithms chosen in the configuration screen. There is one column per algorithm selected.
  5. The VirusTotal Report pane is shown if the “Check with VirusTotal” box was checked in the configuration screen. Read Check for malware using VirusTotal.com for more information.
  6. Save to CSV. When the button is clicked, you are prompted to select or create a file to save to table content into a file. In the dialog box, you can select if you want to save it as Comma Separated file, or as TAB separated file. The results are the same except that one will use commas to separate the columns, while the other will use tabs.
    The resulting file can be viewed in your favorite editor or loaded in a data management tool like a database or in a spreadsheet like the one below.
  7. Save to files. This button allows to save the results using one file per algorithm. When clicked, a popup window invites you to select the algorithms you want to save
    C:\Users\MIMI&W~1\AppData\Local\Temp\msohtmlclip1\01\clip_image007.png
    Just check the box of the algotithm and click the button Save to files.
    Give the selected algorithm, different files will be created.
    They are differentiated by the extensions that are auto-generated. Here’s a table showing which file iw created for which algorithm:

    Algorithm Extension
    CRC (16) .crc16
    CRC (32) .sfv
    Haval (128) .haval128
    Haval (160) .haval160
    Haval (192) .haval192
    Haval (224) .haval224
    Haval (256) .haval256
    MD2 (128) .md2
    MD4 (128) .md4
    MD5 (128) .md5
    Ripe MD (128) .ripemd128
    Ripe MD (160) .ripemd160
    Ripe MD (256) .ripemd256
    Ripe MD (320) .ripemd320
    SHA-1 (160) .sha
    SHA (256) .sha256
    SHA (384) .sha384
    SHA (512) .sha512
    Tiger (128) .tiger128
    Panama (256) .panama256
    Whirlpool (512) .whirlpool512
    Whirlpool1 (512) .whirlpool1
    Square (128) .square128
    Snefru (128) .snefru128
    Snefru (256) .snefru256
    Sapphire (128) .sapphire128
  8. Change VirusTotal API Key. This button opens the windows where you can put your own VirusTotal user key.
    Read the documentation on how to Check for malware using VirusTotal.com to know more about it.
  9. Cancel and back to settings. When clicked, the computation is aborted and you are sent back to the home screen of the Hash Tool.
  10. The Help button that will bring you to this page

What happens to my file when it is processed?

This is a relevant question and, fortunately, the answer is pretty simple: Nothing.
The computation of a file hash is an operation that doesn’t tamper the source file. It’s a read only operation and nothing is changed, added or removed from the file.

The Hash Tool was last modified: May 4th, 2019 by FileVoyager (Author)

Comments are closed.