The Hash Tool

The Hash Tool

As stated in Wikipedia,

“A hash function is any function that can be used to map data of arbitrary size to data of fixed size. The values returned by a hash function are called hash values, hash codes, digests, or simply hashes.”

The goal, here, is not to explain the concept of hashes. For that, other sources like the Wikipedia page will be more helpful. In this page, I explain how to use FileVoyager to compute hashes.

Note: The hash library used in FileVoyager is the Delphi Encryption Compendium (DEC)

Selecting one or more file for the hashing

To get the hash of a file using FileVoyager, select the file(s) in the main form.

If you want to get the hash of a single file, simply focus on that file.

If you want to get the hashes of multiple files, you’ll need to select those files. For instructions on how to select items, please refer to the documentation on items selection and deselection.

Launching the Hash Tool

Once the file has been selected, the Hash Tool can be opened in various ways.

  • If you are using the Ribbon interface, navigate to the Tools tab and click the Hash Tool button (located under the red rectangle in the image below).

  • If you are using the Ribbon interface, navigate to the Tools tab and click the Hash Tool button (located under the red rectangle in the image below)…
    …or access it via the Tools\Hash Tool menu.

  • Lastly, the Hash Tool can also be opened through the context menu by selecting the “Hashes and VirusTotal” entry

Configuring the Hash Tool

When the Hash Tool is displayed, you can view the following elements:

  1. The list of items for which you need to compute a hash.
  2. Buttons to manage the above list. These are quite self-explanatory:
    1. “Add files” allows you to add a file to the list.
    2. “Add folder” allows you to add a folder to the list.
    3. “Remove selected items” will remove the selected items from the list.
  3. “Recursive (…)”.
    1. When not checked, only the files directly under the folders will be computed, and not the content of the subfolders.
    2. When checked, every file inside the folders, regardless of depth, will be computed.
  4. “Check with VirusTotal”. When checked, FileVoyager will automatically check the file hashes against the VirusTotal.com database. To learn how to use this VirusTotal.com integration, check the dedicated documentation: Check for malware using VirusTotal.com.
  5. Algorithms. In this collection of checkboxes, you can select the various algorithms you want to compute.
  6. Compute hashes. When satisfied with the selection of files and folders in (1), and the parameters from (3), (4) and (5), clicking this button will execute the computation of the hashes.

Computation of the hashes

When you start the computation of hashes and have selected the “Check with VirusTotal” checkbox, this window may appear.
This is where you can enter your own VirusTotal user key..
Read the documentation on how to Check for malware using VirusTotal.com to learn more about it.

After closing the aforementioned window, the computation starts, and the following window is displayed:

The file hashes are computed in three steps: Queuing, Processing, and Ready

  1. Files that have been processed are recognizable because their hash fields contain hash values.
  2. When a file is being processed, a progress bar next to the filename is visible to show the progress of the computation.
  3. Files that are queued and not processed yet have empty hash columns.

The results page

The layout of this section is simple, with a table filling the form and a few commands below it.

  1. The first column of the table displays the filename, with an expand button on the left of the file icon. When expanded, it shows another view of the resulting hashes.
  2. The second column displays the file path.
  3. The third column shows the VirusTotal.com score. Read Check for malware using VirusTotal.com for more information.
    This column will not be displayed if the “Check with VirusTotal” box was unchecked in the configuration screen.
  4. Additional columns are dynamically created based on the algorithms selected in the configuration screen. There is one column per algorithm chosen.
  5. If the “Check with VirusTotal” box was checked in the configuration screen, the VirusTotal Report pane is displayed.
    For more information, please refer to the Check for malware using VirusTotal.com documentation.
  6. To save the table content to a file, click the “Save to CSV” button. You will be prompted to select or create a file.
    In the dialog box, you can choose to save it as a     Comma-Separated file, or as TAB-separated file. Both formats have the same results, with one using commas to separate the columns and the other using tabs.
    You can view the resulting file in your favorite editor or load it into a data management tool, such as a database or a spreadsheet.
  7. The “Save to files” enables you to save the results using one file per algorithm. When you click on this button, a pop-up window will prompt you to select the algorithms you want to save.
    C:\Users\MIMI&W~1\AppData\Local\Temp\msohtmlclip1\01\clip_image007.png    Simply select the checkbox next to the desired algorithm(s) and click the “Save to files” button.
    This will create multiple files, each containing the computed hashes for the selected algorithm.
    The resulting files are differentiated by their extensions. The following table show the extensions for each algorithm:

    Algorithm Extension
    CRC (16) .crc16
    CRC (32) .sfv
    Haval (128) .haval128
    Haval (160) .haval160
    Haval (192) .haval192
    Haval (224) .haval224
    Haval (256) .haval256
    MD2 (128) .md2
    MD4 (128) .md4
    MD5 (128) .md5
    Ripe MD (128) .ripemd128
    Ripe MD (160) .ripemd160
    Ripe MD (256) .ripemd256
    Ripe MD (320) .ripemd320
    SHA-1 (160) .sha
    SHA (256) .sha256
    SHA (384) .sha384
    SHA (512) .sha512
    Tiger (128) .tiger128
    Panama (256) .panama256
    Whirlpool (512) .whirlpool512
    Whirlpool1 (512) .whirlpool1
    Square (128) .square128
    Snefru (128) .snefru128
    Snefru (256) .snefru256
    Sapphire (128) .sapphire128
  8. Change VirusTotal API Key. This button opens a window where you can enter your own VirusTotal user key.
    Please refer to the documentation on how to Check for malware using VirusTotal.com for more information.
  9. Cancel and back to settings. This button will abort the computation process and take you back to the home screen of the Hash Tool.
  10. The Help button that will bring you to this page

What happens to my file when it is processed?

This is a relevant question and, fortunately, the answer is simple: Nothing happens to the file.
Computing a file hash is a read-only operation that does not modify the source file in any way. No changes, additions, or deletions are made to the file.

The Hash Tool was last modified: February 19th, 2023 by FileVoyager (Author)

Comments are closed.