Will the 'sha256sum' show corruption if malware infected under following circumstances?

hddfsck · 08-21-2019, 10:08 PM

If I check the sha256sum right after download, and everything is GOOD, and, hypothetically, I leave the .img on my computer, and it gets infected with malware, and I run the same commands again, afterwards, would the sha256sum show that the .img "had changed" and that the sha256sum outputs do NOT match, therefore corruption?

Skaperen · 08-22-2019, 02:09 AM

are you comparing the sha256sum of the file in question against a checksum you saved offline or the one on your computer that was changed so it would match?

ehartman · 08-22-2019, 06:47 AM

Quote:

Originally Posted by hddfsck

I leave the .img on my computer, and it gets infected with malware,

Normally malware will not infect the .img, it will infect what you installed OUT of it.

And anyway: a .img should only be checked against the sha256 value on the original site: a copy of the value on the local machine can be changed just as easily as changing the file(s) it(them)selve(s).
And even then you're not sure as the sha256sum program may have been changed too to show the original value.