Microsoft offers a free File Checksum Integrity Verifier for such purposes.
Information copied from the readme file:
1.What is fciv?
Fciv is a command line utility that computes and verifies hashes of files.
It computes a
SHA1 cryptographic hash of the content of the file.
If the file is modified, the hash is different.
fciv, you can compute hashes of all your sensitive files.
When you suspect that your system has been compromised, you can run a verification to determine which files have been modified.
You can also schedule verifications regularily.
- Hash algorithm:
SHA1 or both ( default
- Display to screen or store hash and filename in a xml file.
- Can recursively browse a directory ( ex fciv.exe c:\ -r ).
- Exception list to specify files or directories that should not be computed.
- Database listing.
- hashes and signature verifications.
- store filename with or without full path.
Usage: fciv.exe [Commands] <Options>
Commands: ( Default -add )
-add <file | dir> : Compute hash and send to output (default screen).
-r : recursive.
-type : ex: -type *.exe.
-exc file: list of directories that should not be computed.
-wp : Without full path name. ( Default store full path)
-bp : base path. The base path is removed from the path name of each entry
-list : List entries in the database.
-v : Verify hashes.
: Option: -bp basepath.
-? -h -help : Extended Help.
-md5 | -sha1 | -both : Specify hashtype, default md5.
-xml db : Specify database format and name.
To display the MD5 hash of a file, type fciv.exe filename
fciv.exe c:\ -r -exc exceptions.txt -sha1 -xml dbsha.xml
fciv.exe c:\mydir -type *.exe
fciv.exe c:\mydir -wp -both -xml db.xml
List hashes stored in database:
fciv.exe -list -sha1 -xml db.xml
fciv.exe -v -sha1 -xml db.xml
fciv.exe -v -bp c:\mydir -sha1 -xml db.xml
4.Database storage format:
The hash is stored in base 64.
You can build a hash database of your sensitive files and verify them regularily or when you suspect that your system
has been compromised.
It checks each entry stored in the db and verify that the checksum was not modified.