Creating md5sum Values of NTFS Files?

[Condor]

How do you create md5sum values on an ntfs drive or file group using Knoppix 5.3.1?
Specifically, C:\Windows\system32\drivers.

I have already created a list of md5sum values on Windows of the "C:\" drive.
I would like to compare the Windows created values to the Linux created values for verifying file integrity.

Do you know if this will produce valid results in detecting changes on the ntfs files?

Are there alternative methods within Knoppix 5.3.1 that would accomplish the same results?

How would I take my ntfs md5sum list and use Knoppix to compare it to the Linux md5sum automatically?

I used Hashtabs to create the values. I don't know if it is done in binary form or not. I noticed that the md5sum in Linux offers -b and -t.
If I used the -t option and Hashtabs calculates via binary, would the hash values be different?

TIA for your input,
Condor

[Condor]

Think I found what I need for MD5summing on NTFS for windows. It is called MD5Summer available Here
It will even let you md5sum cd's and it will be saved in a format compatable with linux md5sum for comparing.

The way I think I will use it; md5sum the windows/system32/drivers directory, the windows install disk of the same files, fire up knoppix, md5sum the ntfs volume directory windows/system32/drivers.
Now compare the Knoppix md5sum (1=w/s32/dr, 2=active win version w/s32/dr, 3=install disk versions) 1>2, 1>3, 2>3.
I hope this will make visible anything lurking.

If this is valid for discovering file discrepencies, your comments would be appreciated.
If there are other methods available through Knoppix I would appreciate those comments as well.

Thanks,
Condor

[Harry Kuhman]

I have already created a list of md5sum values on Windows of the "C:\" drive.

Think I found what I need for MD5summing on NTFS for windows. It is called MD5Summer available [url=http://www.md5summer.org/]...

How do you create md5sum values on an ntfs drive or file group using Knoppix 5.3.1?...

You already seemed to know how to make md5 files under Windows, so I didn't mention md5summer when you first asked. Yea, it's a nice program for creating md5 files. Interface is a bit non-standard, but, once you get used to it, the program is good for both making and testing md5 files. Several other Windows programs will make and test md5 files (quickpar will even test md5s for you, likely can make then also but I'm not certain of that).

You shouldn't need Knoppix to test the md5s, I doubt that any infection of a windows system is going to catch you checking md5s and lie to you with the old value. But testing under Knoppix should work as well. You didn't however ask how to check the existing files that you said you already made with Knoppix, you asked "How do you create md5sum values on an ntfs drive...". IMHO it is still not very safe to write file to an NTFS drive with Knoppix. Read them, sure. Write them, I feel pretty uneasy about that.

[Condor]

What part of creating an md5sum under Knoppix of an ntfs drive directory writes to the ntfs drive?
I thought the process is carried out in ram and stored results in knoppix file system.

I haven't yet created an md5sum with knoppix. I have done so with hash tabs. Unfortunately its stored list isn't compatable with linux.

I was told that the only way to verify 100% of being clean from malware is offline file comparison, Knoppix is one of the suggested methods along with BartPE, WinPE and ERD Commander. Furthermore, virus scanners are only valid with signatures in their data base. So it would not catch a new or altered infection.
I was advised not to create the BartPE or WinPE on an infected system. So this is the dilemma, I only have 1 computer.

This is why I thought Knoppix and md5summing would be a better option, allowing me to do file integrity checks.

Are there other ways to do file comparisons using Knoppix to check the ntfs volume?
[/url]

[Harry Kuhman]

How do you create md5sum values on an ntfs drive....

What part of creating an md5sum under Knoppix of an ntfs drive directory writes to the ntfs drive?

I took you literally, that you wanted to create the md5 files on a NTFS partition, with Knoppix, as written. Of course, you can create an md5 file of files in a NTFS partition elsewhere, such as in RAM drive, quite safely. However, there is really no reason to.

Are there other ways to do file comparisons using Knoppix to check the ntfs volume?
[/url]

Make the md5 checksum file with md5summer under Windows and save it to the NTFS drive. We have to assume that you are doing this when you know (or at least believe) that the system is good, as there would be little to gain from making a md5 set for a known corrupted system. Then you can just check it later with Knoppix (if you don't trust testing it under a potentially compromised Windows system). No need to create another md5 file, no need to write anything at all. Just have Linux read the md5 file and check the saved md5 values for each file against what it can compute now.

I have never done this for system files, but it will work (but see the last paragraph below). I have done this many times for multi-player game files when those files were becoming corrupted and to track down cases where some players had different versions of files than others. It's very handy to get someone to email a md5 file of their game directory and e-mail it to you, where you can quickly find any missing files and and different files. Of course, you have to find out why any differences occur. You can expect configuration files to be different, and for files that shouldn't be different you are still left with determining which version is the right file, but it's a great tool for such tasks.

I also like to put an md5 file on a data CD or DVD to allow one to be aware of any bit rot that has occurred if the files are needed years later. Even better to make a few PAR2 files if you have a little extra space to spare for them, but a tiny md5 file can always be made to fit even if space is tight.

Of course, if you're one of the people who accepts the "security updates" from Microsoft, you may find that a lot of stuff in your Windows directories that you have md5 checksums for has been changed since you accepted the "security updates".

[Condor]

as there would be little to gain from making a md5 set for a known corrupted system.

There is a virus, part of a rootkit, that walks across windows system drivers to maintain its hold. Detection can be done by file size, but because of the rootkit part it may alter the userland info and can't be trusted on a live system. Also, because it walks, when you find the discrepency and compare it, it may have moved to a new location and cleaned its previous location.
Scary that Rustock.C stuff. Rustock author states there maybe a Rustock.D

Just have Linux read the md5 file and check the saved md5 values for each file against what it can compute now.

Do I have to import the list somewhere?
If I have created the md5summer file, what do I do now in knoppix?

(but see the last paragraph below)

Not an issue for me. LL:LR:Whispers "Didn't update yet."

Thanks,
Condor

[Harry Kuhman]

Do I have to import the list somewhere?
If I have created the md5summer file, what do I do now in knoppix?

I believe that the md5 test program in Knoppix is md5sums (or maybe it's md5sum, I can never remember). At least it used to be, I haven't checked it in a while and sorry, I'm on Windows right now and don't have Knoppix handy. Don't move the *.md5 file anywhere, leave it where you created it and where you can test it with md5summer - md5 files contain relative paths but not full paths, so what it finds depends on where the file is when you use it as input for a md5 test program. The should be a man page for more info on md5sums or md5sum (that just a theory, but I would be rather shocked if there was not).