0xhexforgeCTF utility layer
hexforge / guides / sha256-integrity

GUIDE 06 / INTEGRITY

Verify Files with SHA-256

A digest gives a file a stable fingerprint. Used correctly, it detects changed bytes and keeps an investigation tied to the exact artifact you received.

What SHA-256 establishes

SHA-256 maps any byte sequence to a 256-bit digest, commonly displayed as 64 hexadecimal characters. Identical bytes produce the same digest. A one-byte change produces a different value with overwhelming probability.

A matching digest demonstrates byte-for-byte equality with the referenced file. It does not prove that the file is safe, authentic, or trustworthy unless the reference digest itself came from a trusted channel.

A correct comparison workflow

  1. Obtain the expected SHA-256 value from an authoritative source.
  2. Preserve the downloaded or supplied file.
  3. Calculate SHA-256 over the file bytes, not its filename or displayed text.
  4. Compare all 64 hexadecimal characters.
  5. Record the file size, digest, source, and calculation method.

Hexadecimal letters are case-insensitive, but missing characters are not. Remove surrounding whitespace before comparison and reject a value that is not exactly 64 hex characters.

Example result

file: challenge.zip
size: 18442 bytes
sha256: 2cf24dba5fb0a30e26e83b2ac5b9e29e...
source: authorized CTF download
verified: compared with organizer-provided digest

Do not shorten the stored digest as shown in this explanatory example. Keep the complete value in real notes.

Use hashes throughout an investigation

Hash the original before opening or extracting it. When a container produces important members, hash those outputs as well. If you transform a file, give the derivative a new name and digest rather than replacing the original record. This creates a simple chain that teammates can verify.

ArtifactWhy hash it?
Original downloadFix the starting evidence identity
Working copyConfirm it matches the original before analysis
Extracted memberIdentify the exact child artifact
Modified outputDistinguish a derived file from source evidence
Hashing is not malware detection

A digest can be searched in trusted intelligence sources, but an unknown hash is not evidence that a file is harmless. SHA-256 describes identity, not behavior.

Common mistakes

Hashing text instead of the file

The visible contents of a text editor may normalize line endings or character encoding. For file integrity, hash the raw bytes.

Trusting a digest delivered with a compromised file

If an attacker can replace both the file and the adjacent checksum, the comparison still matches. Obtain the expected value through a separate trusted path when authenticity matters.

Using MD5 for new integrity records

MD5 remains useful for matching historical datasets, but collision weaknesses make SHA-256 the better default for new evidence records.