1

How do I find the file from given Hash value in Linux?

Please note that I don't want to find the hash value of a file, I need the opposite of that.

3
  • 5
    I recommend you edit this to give details. Of particular importance is if you know anything about what file it might be. For example, if you know the file is on your computer, you could compute hashes of many files and compare them to that hash. Typical answers to questions like this are along the lines of, "You can't and that's what it means to be a hash," or "Even with a weak hash this is provably impossible in the general case due to the pigeonhole principle," but such answers may or may not be helpful to you. An edit should help clarify what sort of answer would be useful. Nov 24, 2019 at 7:09
  • 5
    Hashing is a "one-way" function. You cannot "create" a file from it's hash. The only way is to search for a match of the hash among a group of files you have at hand!
    – FedKad
    Nov 24, 2019 at 7:24
  • If you have for example the MD5 hash of a file on your system and don't know here it is you can do something like find ~ -exec md5sum {} + | tee ~/homeMD5s.txt | grep yourhash Dec 2, 2019 at 3:09

1 Answer 1

5

From my assumptions and understanding of the question, you could probably do it in several ways.

One way would be, if you know exactly which directory to look for the hash match then you could just pass the hash and then check the files in that directory. So basically what you are doing is this:

myHash="$1"
[[ $(sha256sum fileName | awk {'print $1'}) == "$myHash" ]] && echo "File found"

Simplifying this with a for loop:

checkHash(){
myHash="$1" ## The hash of the file that you want to find
if (( $# == 1 )); then ## Must pass at least one argument
  ## Checking each file in the pwd
  for X in *; do
    if [[ -f $X ]]; then
        local hash=$( sha256sum $X | awk '{print $1}' )
        [[ "$myHash" == "$hash" ]] && { 
          echo "Hash matches for $X";
        }
    fi
  done
fi
}
checkHash "$@"

However, this would not scan the hash of any files started with dot.

Another way would be to do with xargs and find command.

As @MelcomX pointed out with find command you can do it in a one liner, however it might take long time. Good thing about this solution is that you can pass part of the hash and it would still work since it is greping.

find / -exec sha512sum {} + | grep YOURHASHHERE

If this is not what you were looking for then please elaborate your question as @Eliah Kagan suggested in the comment so that we can understand what you were looking for, or consider accepting the answer.

2
  • 1
    And if you don't know the location, you could do it with find / -exec sha512sum {} + | grep YOURHASHHERE But this operation would take very long for the hole system....
    – MelcomX
    Nov 24, 2019 at 8:18
  • 1
    Cool. Possibly making extra instance with xargs -P <10 or 15> to make it go faster would be also very nice. @MelcomX
    – Rakib Fiha
    Nov 24, 2019 at 8:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.