Problem
You want to determine whether any files have been modified or damaged in a set of files.
Solution
To verify the integrity of file sets, use the GetFileHash script provided “Program: Get the MD5 or SHA1 Hash of a File” to generate the signatures of those files in question. Do the same for the files on a known good system. Finally, use the CompareObject cmdlet to compare those two sets.
Discussion
To generate the information from the files in question, use a command like:
dir C:\Windows\System32\WindowsPowerShell\v1.0 | GetFileHash | ExportCliXml c:\temp\PowerShellHashes.clixml
This command gets the hash values of the files from C:\Windows\System32\ WindowsPowerShell\v1.0, and uses the ExportCliXml cmdlet to store that data in a file.
Transport this file to a system with files in a known good state, and then import the data from that file.
$otherHashes = ImportCliXml c:\temp\PowerShellHashes.clixml
You can also map a network drive to the files in question and skip the export, transport, and import steps altogether:
net use x: \\leedesk\c$\Windows\System32\WindowsPowerShell\
v1.0
$otherHashes = dir x: | GetFileHash
Generate the information from the files you know are in a good state:
$knownHashes = dir C:\Windows\System32\WindowsPowerShell\v1.0 | GetFileHash Finally, use the CompareObject cmdlet to detect any differences: CompareObject $otherHashes $knownHashes Property Path,HashValue
If there are any differences, the CompareObject cmdlet displays them in a list, as shown in Example 191.
Example 191. The CompareObject cmdlet showing differences between two files
PS >CompareObject $otherHashes $knownHashes Property Path,HashValue
Path HashValue SideIndicator
Example 191. The CompareObject cmdlet showing differences between two files (continued)
system.management.aut... 247F291CCDA8E669FF9FA... => system.management.aut... 5A68BC5819E29B8E3648F... <=
PS >CompareObject $otherHashes $knownHashes Property Path,HashValue | >> SelectObject Path >>
Path
system.management.automation.dllhelp.xml system.management.automation.dllhelp.xml
For more information about the CompareObject cmdlet, type GetHelp CompareObject. For more information about the ExportCliXml and ImportCliXml cmdlets, type GetHelp ExportCliXml and GetHelp ImportCliXml, respectively.
