How to check if a file has been modified

Does the modified date show whether a file was tampered with?

No. The modified date, the created date and the name are details the operating system keeps alongside the file, and they change through everyday operations or on demand.

• Copying a file to another drive, downloading it from cloud storage or extracting it from a .zip can give it new dates even though the content is identical.
• Common utilities let anyone set whatever date they like.
• The reverse also works: a file can be edited and its earlier date put back afterward.
• The name has no link to the content. Two files with the same name can differ, and two with different names can be the same file.

To know whether the content changed, you have to look at the content. Comparing two files byte by byte works, but you need both of them. A hash solves that: it condenses the content into a short string you can write down, send and publish.

What is a SHA-256 hash or checksum?

It is the output of running the file's content through a mathematical function that always returns a code of 64 hexadecimal characters. You will also see it called a checksum, a digest or a fingerprint. Three properties make it useful:

• It is deterministic. The same content always gives the same hash, on any computer and with any program.
• It is sensitive. Changing one letter, one pixel or one space produces an entirely different hash that looks nothing like the previous one.
• It is one-way. The file cannot be rebuilt from the hash, so publishing the hash does not reveal the content.

The hash depends on the content alone. Renaming the file or moving it to another folder does not change it.

How do you compute a SHA-256 checksum on Windows, macOS and Linux?

All three ship with a built-in tool, so there is nothing to install. Open a terminal in the folder that holds the file and type the command, replacing file.pdf with the real name.

If the name contains spaces, wrap it in quotes. The result is a single line of 64 characters made of digits and the letters a to f. Uppercase or lowercase makes no difference: it is the same value.

If you would rather avoid the terminal, some tools compute the hash in the browser. Prefer the ones that process the file on your device instead of uploading it to a server.

What to compare the hash against

Against a reference value that was obtained earlier and comes from a source you trust. Without a reference, a hash tells you nothing. It is just the mathematical name of the file you hold today.

• Download pages. Many software projects publish the SHA-256 of each installer. Compare the hash of what you downloaded with the one on the official page.
• A certificate. If the file was certified at some point, the certificate holds the hash it had that day.
• A value sent earlier. An email, meeting minutes or a contract in which someone wrote down the document's hash.

Compare the whole string, not just the beginning and the end. The safest way is to paste both into one document, one under the other, or to use the find function to locate one inside the text of the other.

What does a checksum mismatch mean?

It means the file you hold is not identical, byte for byte, to the one that produced the reference hash. It does not say what changed, how much or with what intent. Many mismatches have innocent causes:

Before concluding there was tampering, look for the original copy: the one in the sent email, in the backup or on the source device. If the file is an installer and its hash does not match the published one, do not run it. Download it again from the official site.

Why are MD5 and SHA-1 not recommended?

Because collision attacks are known for both: it is possible to deliberately build two different files that share the same hash. That breaks exactly the guarantee you want when money or a dispute is involved.

MD5 and SHA-1 still catch accidental errors, such as a corrupted download. To check that nobody altered a file, use SHA-256 or another function from the SHA-2 or SHA-3 family. If the only reference available is an MD5 value, treat it as an indication and not as a guarantee.

Does a hash prove when a file was created?

No. A hash contains no date: it can be computed today on a file created this morning. It also says nothing about who made the file or whether its content is true.

The date comes from a trusted timestamp. A time-stamping authority signs the hash together with the date and time under the RFC 3161 standard, which establishes that this exact content existed no later than that moment. The details are in what a trusted timestamp is. If you need that record for a file of your own, Certify a file does it.

How does verifying a file against a certificate work?

It compares the file you hold with the hash stored in the certificate. On the verification page you enter the certificate code, or arrive through the QR code on the PDF, and see its status and the timestamp date. Then you select the file: its fingerprint is computed in your browser and checked against the certificate. The file is not uploaded. If you do not have the code, you can also start from the file directly.

A match means you are holding the same content that was certified on that date. No match means it is a different file or an altered version, for one of the reasons in the table above. That check establishes integrity and date. It does not guarantee legal value and does not replace a notary or an expert.

Checklist and common mistakes

1. Work on a copy and leave the original unopened.
2. Compute the SHA-256 with the command for your system.
3. Get the reference hash from a trusted, earlier source.
4. Compare the two complete strings.
5. If they do not match, find the original copy before drawing conclusions.
6. If you need to establish a date, add a trusted timestamp.

Mistakes that keep coming up:

• Trusting the modified date or the file name.
• Taking the reference hash from the same place the suspect file came from. Whoever could change the file could also change the value published next to it.
• Hashing the .zip and comparing it with the hash of the document inside, or the other way around.
• Opening the file "just to look" and saving on the way out.
• Eyeballing the first few characters and assuming the rest is fine.
• Believing a matching hash proves authorship or truth. It proves the content is identical, nothing more.