Checksum for Protecting Read-Only Documents

My father owns a small business and has to hand over several year's worth of financial documents to his insurance's auditor. He's asked me to go through and make sure everything is "read-only" so the data (the files) absolutely, positively cannot be modified or manipulated (he's a bit paranoid).

We're talking about 20,000 documents (emails, spreadsheets, etc.).

My first inclination was to place everything inside of one root folder ("mydadsdocs/") and then write a script that recursively traversed its directory subtree and set the file permissions to read-only.

But then I got to thinking: that's a lot of work for me to do to satisfy an old man who is just being paranoid, and afterall, if someone really wanted to modify a read-only file, it would be pretty easy to change file permissions anyways, soo....

Is there like a checksum I could run on the root folder, something that was very quick and easy, and that would basically "stamp" the data in that folder so if someone did change it, my father would have someone of knowing/proving it?

If so, how?

If not, any other recommendations that are quick, cheap (free) and effective?

Kim

Posted 2011-06-27T14:50:18.180

Reputation: 51

Checksums are of little use if they can also be changed. Or they are stored separately in a safe place? Still, I think the correct tool for this scenario is cryptographic signatures. (Unless an adversary knows the private key, he cannot forge signatures of these files) – Display Name – 2015-12-31T14:48:07.287

Do you have access to Powershell on the machine? – EBGreen – 2011-06-27T15:23:54.517

I guess (it's his machine and he'll give me access to whatever I need) but I've never worked in PS before – Kim – 2011-06-27T15:29:34.993

I suppose you could zip the directory and hash the zip file. Better yet, cryptographically sign the zip file (which includes hashing it). – Joey Adams – 2011-06-27T15:37:34.130

Thanks Joey - how could I hash the zip, is there a utility I need to download or is that something I could call from the command line? – Kim – 2011-06-27T15:38:48.153

I think what he means by hashing the zip file is to run an md5 checksum against it. There are many md5 tools out there (both command line and graphical). – Matrix Mole – 2011-06-27T16:52:53.930

Please note that it has become rather easy to generate MD5 collisions, especially if the file format allows it (.zip does). Use a stronger hash. – user1686 – 2011-12-15T20:29:16.637

Answers

Burn the data to a readonly CD or DVD. Put it to a safe.

bbaja42

Posted 2011-06-27T14:50:18.180

Reputation: 2 815

ReadOnly media (not merely file formats) is a great method of ensuring the data isn't modified or doctored in anyway; although putting the disc into a safe won't help when the data is being handed over to someone to examine. – Matrix Mole – 2011-06-27T16:51:15.537

7-zip will calculate checksums for any folder without it having to be zipped. Just open up the 7-zip File Manager -> find the root folder containing all the files you will be sending over to the Auditor -> right-click -> click on "Calculate Checksum".

The only drawback is that you can't copy and paste it from the result dialog (but it's short so you can probably type it out).

Tarek Fadel

Posted 2011-06-27T14:50:18.180

Reputation: 435

You can get the checksum here.

It can create a "root" hash file which will "stamp" all the files in the tree.

F.M.

Posted 2011-06-27T14:50:18.180

Reputation: 11

The "read only" bit is not part of the file permissions: it's only a leftover from MS-DOS single-user world. The real file permissions are much more secure. If you, as an administrator, took ownership of all the files, then set their permissions to only allow read access, then nobody but the file's owner would be able to change said permissions or the file's contents. Even the owner would be disallowed from modifying the file itself. You could even make a dedicated account for such files... Under Permissions → Advanced you'll also find an "Audit" tab, which can cause all modifications (or attempts of) to be logged to the Security log. (Of course, any other administrator would be able to take ownership again or to clear the security log, but this can be solved by not giving untrusted people administrator access. It won't protect against someone booting into another OS, either, so the computer needs to be physically secured.)

A better option is to store all files in some read-only media such as DVDs, along with a signature (probably a digital one using PGP, or maybe a written one on the DVD itself) to mark that copy as "good".

user1686

Posted 2011-06-27T14:50:18.180

Reputation: 283 655

Create a checksumor a signatureof every file or a archive of every file.

For checksum download OpenSSL for Windows and run something like

openssl sha1 the_file

Going for signature which should be more reliable, download PGP tools: OpenPGP.org or The GNU Privacy Guard

tidbeck

Posted 2011-06-27T14:50:18.180

Reputation: 1 365

Try using the HashCheck Shell Extension utility (http://code.kliu.org/hashcheck/).

The HashCheck Shell Extension makes it easy for anyone to calculate and verify checksums and hashes from Windows Explorer. In addition to integrating file checksumming functionality into Windows, HashCheck can also create and verify SFV files (and other forms of checksum files, such as .md5 files).

It features the following:

Checksum/hash verification
Shell integration (via properties dialog)
Lightweight
Free and open-source

Alex Essilfie

Posted 2011-06-27T14:50:18.180

Reputation: 1 173

If you want to protect files from intentional modification, stay the hell away from SFV files -- they usually use CRC32 checksums, which take seconds to break, and are only intended to guard against accidental corruption anyway. Cryptographic hashes should be used instead, and even then MD5 will be fairly weak; SHA256 is a better choice if the program supports it. – user1686 – 2011-12-15T20:27:26.780

It's true CRC32 can be broken quite easily. No two ways about that. But that is not an issue here because 1) the utility supports other hashing algorithms like MD5 and SHA1 and 2) storing the checksum data with the files being broueated is just like leaving the key to a safe go the lock; it's too easy for anyone to modify the files and update the relevant entries in the hashes file as long as the algorithm is known. It just makes sense to store your hashes file somewhere secure. – Alex Essilfie – 2011-12-15T22:18:22.607

However, even if you store the hashes in a secure location, what prevents someone from calculating a file's CRC32 checksum or MD5 hash, then inserting a modified file with the same hash? – user1686 – 2011-12-15T22:30:50.993

You tell me what you'd do about it. From my standpoint, you've got two options: roll out your own hashing algorithm (which could be insecure anyway) or use multiple hashes (AFAIK, it's fairly difficult to have two different files with the same hash signatures in multiple hash algorithms). – Alex Essilfie – 2011-12-15T22:47:46.020

Or 3) Use an algorithm that is considered secure against current technologies, such as SHA-256 or RIPEMD-160. (That is what I was trying to say in my first comment -- even if the program supports strong hashes, I have a strong feeling that it will use MD5 or CRC32 by default, so the user will have to pay attention.) – user1686 – 2011-12-15T23:18:17.377