Howto: Verify Downloaded Linux / BSD DVD or CD ISO images for integrity

You need to verify that that downloaded Linux DVD or ISO images are intact before you burn and use them. This is security feature. But how do you verify ISO images?

Answer is quite simple use md5sum command to compute and check MD5 message digest.

Why verify ISO images?

a) To protect yourself
b) Verify that a file has not changed as a result of file transfer, disk error, cracker attacks, etc.

How does it work?

When you run md5sum command on ISO file, you get checksum (or hash) on screen. You need to compare this checksum with original. It works as a compact digital fingerprint of a file. You can then compare the MD5 hash of your download ISO file, to the known good hash of the file you are checking. If the two values match, you are safe and use the ISO image.

Example

Let us download FreeBSD ISO image:
$ cd /tmp
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/6.2-RELEASE-i386-bootonly.iso

Next download MD5 checksum:
$ wget ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.2/CHECKSUM.MD5

Generate MD5 hash for ISO image

$ md5sum 6.2-RELEASE-i386-bootonly.iso
Output:

4e8701ac951bc4537f8420fdac7efbb5  6.2-RELEASE-i386-bootonly.iso

Verify ISO image

See the known good hash of the file (6.2-RELEASE-i386-bootonly.iso):
$ md5sum -c CHECKSUM.MD5
Output:

6.2-RELEASE-i386-bootonly.iso: OK

You can also use following command for the same purpose:

A note for Windows XP / Vista users

🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source & DevOps topics via:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
4 comments… add one
  • el_b Sep 12, 2009 @ 5:39

    What about checking a dvd itself? I once burned slack 13 32bit to a dvd with growisofs, and it seemed to be corrupted, it gave me an error about glibc… I was trying to use XFS, it seems to be the best choice and has worked well for me.

  • tekkon Nov 20, 2008 @ 15:24

    I know this article has been posted for a while but can you please help me understand the situation I’m facing?

    I tried using the method above to verify my FreeBSD 7 download from “ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/”.

    1st time using firefox 3, 2nd time with a firefox download manager “downloadthemall” and third time using wget.

    For all 3 downloads all checksums were different and didn’t match the CHECKCUM.MD5 provided at “ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/”.

    Makes me wonder if the difference are caused either by different download methods or corrupted downloads.

  • 🐧 nixCraft Jul 30, 2007 @ 21:31

    DON,

    You can try out your specific questions at our forum

  • DON Jul 30, 2007 @ 10:59

    I am a beginner to linux. I want to master linux and gnu C. I would like to get some tips for that from experienced people like you. Please help me in this regard

    Thanks in advance
    DON

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.