Howto: Verify Downloaded Linux / BSD DVD or CD ISO images for integrity

You need to verify that that downloaded Linux DVD or ISO images are intact before you burn and use them. This is security feature. But how do you verify ISO images?

Answer is quite simple use md5sum command to compute and check MD5 message digest.

Why verify ISO images?

a) To protect yourself
b) Verify that a file has not changed as a result of file transfer, disk error, cracker attacks, etc.

How does it work?

When you run md5sum command on ISO file, you get checksum (or hash) on screen. You need to compare this checksum with original. It works as a compact digital fingerprint of a file. You can then compare the MD5 hash of your download ISO file, to the known good hash of the file you are checking. If the two values match, you are safe and use the ISO image.

Example

Let us download FreeBSD ISO image:
$ cd /tmp
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/6.2-RELEASE-i386-bootonly.iso

Next download MD5 checksum:
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/CHECKSUM.MD5

Generate MD5 hash for ISO image

$ md5sum 6.2-RELEASE-i386-bootonly.iso
Output:

4e8701ac951bc4537f8420fdac7efbb5  6.2-RELEASE-i386-bootonly.iso

Verify ISO image

See the known good hash of the file (6.2-RELEASE-i386-bootonly.iso):
$ md5sum -c CHECKSUM.MD5
Output:

6.2-RELEASE-i386-bootonly.iso: OK

You can also use following command for the same purpose:

• GNU gpg
• sha1sum command

A note for Windows XP / Vista users

• You can verify MD5 checksum of an ISO file under Windows XP/vista using winmd5sum program.