The Importance of File Integrity
When you download a large software installer, a firmware update, or an ISO image for an operating system, how do you know the file arrived perfectly intact? A momentary drop in your network connection could cause a single missing byte, which might silently corrupt the installer.
Even worse, what if a malicious actor intercepted your download or compromised the server you downloaded it from, replacing the legitimate file with a virus masquerading under the exact same name?
To solve this, developers provide “checksums” or “hashes”—long, unique strings of letters and numbers generated by running the original file through a complex mathematical algorithm (like SHA-256). If even a single pixel in a 5GB file changes, the resulting hash will be completely different.
You can verify a file’s integrity natively in Windows using the powerful Get-FileHash cmdlet in PowerShell.
Step 1: Understanding the Command
The Get-FileHash cmdlet calculates the hash value of a file. By default, it uses the SHA-256 algorithm, which is the modern industry standard for cryptographic security.
Open Windows PowerShell (you can find it in the Start menu). You do not need to run it as an administrator to check standard files in your Downloads folder.
The basic syntax is:
Get-FileHash -Path "C:\Path\To\Your\File.exe"
Step 2: Checking a Downloaded File
Let’s assume you just downloaded a Linux installation ISO named ubuntu-22.04.iso to your standard Downloads folder.
In PowerShell, type:
Get-FileHash -Path C:\Users\YourUsername\Downloads\ubuntu-22.04.iso
(Tip: You can type Get-FileHash -Path and then simply drag and drop the file from File Explorer directly into the PowerShell window; it will automatically type out the correct path for you!)
Press Enter. For a large file like an ISO, PowerShell might take 10 to 30 seconds to read the entire file and perform the complex math.
The output will display the Algorithm used (SHA256) and the Hash value.
Step 3: Comparing the Hash
Now, go back to the website where you downloaded the file. The developer should have a section labeled “Checksums,” “Hashes,” or “Verify your download.”
Visually compare the long string generated by PowerShell to the string provided on the website. If they match exactly, the file on your hard drive is a 100% mathematically identical copy of the file the developer released. It is safe to use.
If the hash differs even slightly, do not run the file. Delete it and download it again, as it is either corrupted or compromised.
Step 4: Using Different Algorithms (MD5 or SHA-1)
While SHA-256 is the modern standard, some older websites or internal corporate systems still use older, less secure algorithms like MD5 or SHA-1.
If the website only provides an MD5 hash, your default SHA-256 hash will not match it. You must instruct PowerShell to use the specific MD5 algorithm using the -Algorithm parameter.
Get-FileHash -Path C:\Downloads\old_software.exe -Algorithm MD5
PowerShell natively supports several algorithms, including:
- SHA1
- SHA256 (Default)
- SHA384
- SHA512
- MD5
By making Get-FileHash a regular part of your software installation routine, you can completely eliminate the risk of running corrupted or tampered files on your Windows system.