0

I want to write Windows batch commands that can specify individual files or all files recursively in a folder. Either way, the output should be the full name (including path) of a file and its SHA256 hash value on a single line. For instance, as described elsewhere, I found that the Linux rhash tool could produce results that looked something like this:

6eb6c33775113d2ca571f3f7ad7afccbcd9fbb3938f3e35  /Test/hot plug BIOS settings.wav

By contrast, in that test, HASHSUM.BAT (as an example of a relevant Windows tool) declined to produce any results for about 1% of files in a folder.

My question: is there a Windows tool or command that can produce a list of files (with paths) and their SHA256 hashes, one per line? I want to be able to do this with commands, so as to mass-produce results for a potentially large number of files in different folders, without having to select them one at a time in a GUI.

Update: I'd like the option of using SHA512. I've come to discover that, counterintuitively, its output can be significantly faster on my hardware.

Improve this question

1 Answer 1

Reset to default
1

This can be done with standard commands in Powershell. As a test, I went to the directory in which I had the SysInternals Suite unpacked, and executed the following command

Get-ChildItem | Get-FileHash

and the first few lines of output were

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          07C3CA902A948A4A74977A539F297B22739179CFD0599A253F73AEAA2F7D94E7       Z:\SysInternals Suite\accesschk.exe
SHA256          C549F7159BB4087C6ABDC2943166673775ED8364BBC774F3BC3DBDB337C9AD76       Z:\SysInternals Suite\accesschk64.exe
SHA256          A4CC61F6C7ED716E4622E12B75F05EA17E79A45F0D8BD6855C340A30EC882B47       Z:\SysInternals Suite\AccessEnum.exe
SHA256          A89A59BE46F8511E385427C942D352429072B5A83D501CA08463942ABCF8E5A3       Z:\SysInternals Suite\AdExplorer.chm
SHA256          BB45D8FFE245C361C04CCA44D0DF6E6BD7596CABD70070FFE0D9F519E3B620EA       Z:\SysInternals Suite\ADExplorer.exe
SHA256          7F9C32BD71E48C6CD1AECBAEAB7031A4604FC52651272E1446B6773FD6D5B5DA       Z:\SysInternals Suite\ADInsight.chm
SHA256          DEAE099E25B2E77E2E01F9A9D813A2392B70CDE20B5C2E92AE769454150CAABA       Z:\SysInternals Suite\ADInsight.exe
SHA256          D6F2383412056BBFE4C0B2EAD055782008AD4BB5F758C0C582E91C9624F9B5EC       Z:\SysInternals Suite\adrestore.exe
SHA256          324C64D24818A0BE63A43A8DF678B88DCA4F8959841F91F4875CC6ED0E93F549       Z:\SysInternals Suite\Autologon.exe
SHA256          48EAFDBFA0CE0933ED4C3EE18368641292698638AF602291420370CBAA830FC9       Z:\SysInternals Suite\autoruns.chm
SHA256          FE7D78B9CCAF689785740E14E64A6B1B551667F82CAF3CE4FF236E7BA61EDE90       Z:\SysInternals Suite\Autoruns.exe

which appears to be a good match for your request. If you specifically want to exclude reporting the algorithm used, then

Get-ChildItem | Get-FileHash | Select-Object Hash,Path

should do the trick for you. See Microsoft Docs on Get-FileHash for more information.

Improve this answer
4
  • When using SHA512, the output is truncated. This gives me the hash: Get-FileHash -Algorithm SHA512 -Path (Get-ChildItem "D:\Current\*.*" -Force -Recurse) | Select-Object Hash,Path | Format-Table -Wrap -Autosize. But it doesn't include the path. I'm stuck there.
    – Ray Woodcock
    Dec 9, 2021 at 7:40
  • 1
    For the SHA512 output, don't rely on the Format-* cmdlets; they will do their best to fit within the available screen. Try using regular string output cmdlets (e.g., Out-Default) and format the output the way you want with the -f operator.
    – Jeff Zeitlin
    Dec 9, 2021 at 12:31
  • I think this works: Get-FileHash -Algorithm SHA512 -Path (Get-ChildItem 'D:\folder\*.*' -Force -Recurse) | Select-Object Hash,Path | Out-File -filePath 'D:\Output.txt' -Encoding ASCII -Width 400. The width seems sufficient for the default maximum Windows path length (260 chars.) plus SHA-512 (128 chars.). Some comments seemed to say the ASCII encoding avoids problems when reading the output in Excel. Exporting to text rather than CSV avoids interpretation of commas in the filename or path as delimiters. ... Thanks for your help!
    – Ray Woodcock
    Dec 9, 2021 at 17:54
  • Correction: it seems I should use -LiteralPath rather than -Path for Get-Filehash. For further updates, see my writeup: raywoodcockslatest.wordpress.com/2021/12/08/ransomware-hash
    – Ray Woodcock
    Dec 9, 2021 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.