jessek / hashdeep

Other
694 stars 130 forks source link

Audit subset of known - "hashdeep -k -f -a" #392

Open peterpepo opened 4 years ago

peterpepo commented 4 years ago

Hello, please could be the -f switch used to audit defined list of files?

I will try to explain my situation by example: I have an archive folder with 100 files in it. This archive folder is mirrored to two locations (location A containing 40 files, B containing 60files), each containing subset of archive files, based on various conditions.

On my source I create hashlist of entire archive - 100 files. On locations A and B I would like to audit these files, meaning I would like to see:

  1. What files are there, which shouldn't be there.
  2. What files aren't there which should be there.
  3. What files are on both sides but differ in size.

Conditions 1. and 2. makes me use -a switch. (If I used -x or -m, I get only files on source and location which hash does or doesn't match).

When I audit on location_a though, I get failed due to missing 60 files. This is expected. Same for location_b - missing 40 files.

What I would expect after supplying list of files in -f with -a is following:

  1. All files which are in the folder and not in -> FAIL (without actual hashing)
  2. All files which are not in the folder, but listed in the -> FAIL (missing file)
  3. File which is both in and in the folder, hash is calculated and compared to -k

Is there anything wrong with my understanding/expectation? How could I achieve similar behaviour?

As a workaround, I can calculate hashes on location_a, but it is already too late, since file might have corrupted during transfer. Alternatively, I could combine my files somehow and prepare based on and use that one to verify..