Howto: Verify Downloaded Linux / BSD DVD or CD ISO images for integrity

by on July 26, 2007 · 4 comments· LAST UPDATED July 26, 2007

in , ,

You need to verify that that downloaded Linux DVD or ISO images are intact before you burn and use them. This is security feature. But how do you verify ISO images?

Answer is quite simple use md5sum command to compute and check MD5 message digest.

Why verify ISO images?

a) To protect yourself
b) Verify that a file has not changed as a result of file transfer, disk error, cracker attacks, etc.

How does it work?

When you run md5sum command on ISO file, you get checksum (or hash) on screen. You need to compare this checksum with original. It works as a compact digital fingerprint of a file. You can then compare the MD5 hash of your download ISO file, to the known good hash of the file you are checking. If the two values match, you are safe and use the ISO image.

Example

Let us download FreeBSD ISO image:
$ cd /tmp
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/6.2-RELEASE-i386-bootonly.iso

Next download MD5 checksum:
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/CHECKSUM.MD5

Generate MD5 hash for ISO image

$ md5sum 6.2-RELEASE-i386-bootonly.iso
Output:

4e8701ac951bc4537f8420fdac7efbb5  6.2-RELEASE-i386-bootonly.iso

Verify ISO image

See the known good hash of the file (6.2-RELEASE-i386-bootonly.iso):
$ md5sum -c CHECKSUM.MD5
Output:

6.2-RELEASE-i386-bootonly.iso: OK

You can also use following command for the same purpose:

A note for Windows XP / Vista users

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 4 comments… read them below or add one }

1 DON July 30, 2007 at 10:59 am

I am a beginner to linux. I want to master linux and gnu C. I would like to get some tips for that from experienced people like you. Please help me in this regard

Thanks in advance
DON

Reply

2 nixCraft July 30, 2007 at 9:31 pm

DON,

You can try out your specific questions at our forum

Reply

3 tekkon November 20, 2008 at 3:24 pm

I know this article has been posted for a while but can you please help me understand the situation I’m facing?

I tried using the method above to verify my FreeBSD 7 download from “ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/”.

1st time using firefox 3, 2nd time with a firefox download manager “downloadthemall” and third time using wget.

For all 3 downloads all checksums were different and didn’t match the CHECKCUM.MD5 provided at “ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/”.

Makes me wonder if the difference are caused either by different download methods or corrupted downloads.

Reply

4 el_b September 12, 2009 at 5:39 am

What about checking a dvd itself? I once burned slack 13 32bit to a dvd with growisofs, and it seemed to be corrupted, it gave me an error about glibc… I was trying to use XFS, it seems to be the best choice and has worked well for me.

Reply

Leave a Comment

Tagged as: , , , , , , , , ,

Previous post:

Next post: