5

My father owns a small business and has to hand over several year's worth of financial documents to his insurance's auditor. He's asked me to go through and make sure everything is "read-only" so the data (the files) absolutely, positively cannot be modified or manipulated (he's a bit paranoid).

We're talking about 20,000 documents (emails, spreadsheets, etc.).

My first inclination was to place everything inside of one root folder ("mydadsdocs/") and then write a script that recursively traversed its directory subtree and set the file permissions to read-only.

But then I got to thinking: that's a lot of work for me to do to satisfy an old man who is just being paranoid, and afterall, if someone really wanted to modify a read-only file, it would be pretty easy to change file permissions anyways, soo....

Is there like a checksum I could run on the root folder, something that was very quick and easy, and that would basically "stamp" the data in that folder so if someone did change it, my father would have someone of knowing/proving it?

If so, how?

If not, any other recommendations that are quick, cheap (free) and effective?

7
  • Do you have access to Powershell on the machine?
    – EBGreen
    Jun 27, 2011 at 15:23
  • I guess (it's his machine and he'll give me access to whatever I need) but I've never worked in PS before
    – Kim
    Jun 27, 2011 at 15:29
  • I suppose you could zip the directory and hash the zip file. Better yet, cryptographically sign the zip file (which includes hashing it).
    – Joey Adams
    Jun 27, 2011 at 15:37
  • Thanks Joey - how could I hash the zip, is there a utility I need to download or is that something I could call from the command line?
    – Kim
    Jun 27, 2011 at 15:38
  • I think what he means by hashing the zip file is to run an md5 checksum against it. There are many md5 tools out there (both command line and graphical). Jun 27, 2011 at 16:52

6 Answers 6

3

Burn the data to a readonly CD or DVD. Put it to a safe.

1
  • ReadOnly media (not merely file formats) is a great method of ensuring the data isn't modified or doctored in anyway; although putting the disc into a safe won't help when the data is being handed over to someone to examine. Jun 27, 2011 at 16:51
1

7-zip will calculate checksums for any folder without it having to be zipped. Just open up the 7-zip File Manager -> find the root folder containing all the files you will be sending over to the Auditor -> right-click -> click on "Calculate Checksum".

The only drawback is that you can't copy and paste it from the result dialog (but it's short so you can probably type it out).

1

The "read only" bit is not part of the file permissions: it's only a leftover from MS-DOS single-user world. The real file permissions are much more secure. If you, as an administrator, took ownership of all the files, then set their permissions to only allow read access, then nobody but the file's owner would be able to change said permissions or the file's contents. Even the owner would be disallowed from modifying the file itself. You could even make a dedicated account for such files... Under Permissions → Advanced you'll also find an "Audit" tab, which can cause all modifications (or attempts of) to be logged to the Security log. (Of course, any other administrator would be able to take ownership again or to clear the security log, but this can be solved by not giving untrusted people administrator access. It won't protect against someone booting into another OS, either, so the computer needs to be physically secured.)

A better option is to store all files in some read-only media such as DVDs, along with a signature (probably a digital one using PGP, or maybe a written one on the DVD itself) to mark that copy as "good".

1

Create a checksumor a signatureof every file or a archive of every file.

For checksum download OpenSSL for Windows and run something like

openssl sha1 the_file

Going for signature which should be more reliable, download PGP tools: OpenPGP.org or The GNU Privacy Guard

1

You can get the checksum here.

It can create a "root" hash file which will "stamp" all the files in the tree.

0

Try using the HashCheck Shell Extension utility (http://code.kliu.org/hashcheck/).

The HashCheck Shell Extension makes it easy for anyone to calculate and verify checksums and hashes from Windows Explorer. In addition to integrating file checksumming functionality into Windows, HashCheck can also create and verify SFV files (and other forms of checksum files, such as .md5 files).

It features the following:

  • Checksum/hash verification
  • Shell integration (via properties dialog)
  • Lightweight
  • Free and open-source
5
  • If you want to protect files from intentional modification, stay the hell away from SFV files -- they usually use CRC32 checksums, which take seconds to break, and are only intended to guard against accidental corruption anyway. Cryptographic hashes should be used instead, and even then MD5 will be fairly weak; SHA256 is a better choice if the program supports it. Dec 15, 2011 at 20:27
  • It's true CRC32 can be broken quite easily. No two ways about that. But that is not an issue here because 1) the utility supports other hashing algorithms like MD5 and SHA1 and 2) storing the checksum data with the files being broueated is just like leaving the key to a safe go the lock; it's too easy for anyone to modify the files and update the relevant entries in the hashes file as long as the algorithm is known. It just makes sense to store your hashes file somewhere secure. Dec 15, 2011 at 22:18
  • However, even if you store the hashes in a secure location, what prevents someone from calculating a file's CRC32 checksum or MD5 hash, then inserting a modified file with the same hash? Dec 15, 2011 at 22:30
  • You tell me what you'd do about it. From my standpoint, you've got two options: roll out your own hashing algorithm (which could be insecure anyway) or use multiple hashes (AFAIK, it's fairly difficult to have two different files with the same hash signatures in multiple hash algorithms). Dec 15, 2011 at 22:47
  • Or 3) Use an algorithm that is considered secure against current technologies, such as SHA-256 or RIPEMD-160. (That is what I was trying to say in my first comment -- even if the program supports strong hashes, I have a strong feeling that it will use MD5 or CRC32 by default, so the user will have to pay attention.) Dec 15, 2011 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .