I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.
EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.