verify your file's MD5 checksums!

[scary alien]

verify your file's MD5 checksums!

Its always a good idea to validate a file's MD5 checksum before and after you download it (and after placing it on your /sdcard). Reputable sites/sources should publish the MD5 sums for the files hosted there. Beware of those that do not. Verifying the MD5 sum of the file that you've downloaded ensures that you have a full, complete, and uncorrupted version of the file.​

Note: erisuser1 has some excellent points about when and why an MD5 sum would (and would not necessarily) be applicable. Read this very informative post for more information: http://androidforums.com/all-things-root-eris/127861-universal-eris-root-dummies-7.html#post1296149

--- edit 8/11/2010 --- Okay, so I realized that not everyone could actually verify their MD5 checksums directly on their phone via the method I originally published below. So, I decided to create my own Android application to do this. Here's the result of that effort. Many thanks to jcase over at XDA for helping me get started doing this by providing me a sample project and some starter code he had on-hand.

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
edit 3/29/2011:

My AFV (Android File Verifier) app (free in the Android Market)
is the successor to the following checksum app and has a much
better UI and more features
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*


Download my (free) v2.2 app: View attachment MD5-Checksum-v2.2.apk
(MD5 checksum: 3aec3fd4cae8f200db8457894ae4193f)

Here's the app details (click 'Show' to view):

Spoiler

// ScaryAlienWare MD5/SHA1 Checksum utility v2.2
//
// developed August-2010 by Android Forum's "scary alien"
//
// Features:
//
// - calculates MD5 or SHA1 checksum of specified file
// - defaults to /sdcard/download directory
// - copies calculated checksum to clipboard
// - also displays file size
// - tested on HTC Droid Eris Android 2.1
// - tested on Motorola Droid-X Android 2.1
// - tested on Motorola Cliq Android 1.5
// - very light-weight app (only 36kb in size)
// - v2.2 now includes file-selector, menu, jar-file verification)
//
// Special thanks to:
//
// - jcase at XDA for allowing me to view example project co-authored w/eclips3
// and for the starter MD5 Java code; this was a huge help and I wouldn't have
// tried this without jcase's help and encouragement
//
// - RLK for helping me test on his Motorola Cliq

Here are some screenshots:



Note: during my testing, I realized/discovered you can actually view a file's MD5 checksum using Astro File Manager (i.e., via viewing a file's details). So, you don't really need this application but my version also calculates SHA1 checksums and was pretty fun to develop .

Enjoy and let me know if you have any questions. --- edit 8/11/2010 ---

You have several different options for doing this (note: all of these examples use the file gscript.zip (that I placed in the /sdcard/download directory) referenced in the http://androidforums.com/all-things-root-eris/127861-universal-eris-root-dummies.html thread):


Checking Directly On Your Phone

You actually now have several options for checking MD5 sums on your phone:

- via my free app (View attachment MD5-Checksum-v2.2.apk) [gratuitous/shamelss plug ]; download and manually install

- via ManD5 Lite (free app in the Market) [this app did not work for me at the time I first posted this thread; it does work, wonderfully, now]

- via Astro File Manager (long-press your file and select 'Details')

- via Android Terminal Emulator [note: not all phones can do this since the md5sum utility may not be present/installed] by typing "md5sum filename" (you might need to long-press the menu key to bring-up the keyboard)

　
Checking Via The Android Software Development Kit (SDK)

1. Download and install the Android SDK

2. Start-up Windows Command Prompt (or Terminal for Macs)

3. Change to the SDK's tools directory

4. Enter adb shell md5sum /sdcard/download/gscript.zip

C:\>
c:\>[B]cd c:\android-sdk-windows\tools[/B]
C:\android-sdk-windows\tools>[B]adb shell md5sum [COLOR=#0000ff][COLOR=#0000ff]/sdcard/download/gscript.zip[/COLOR][/COLOR][/B]
[COLOR=#0000ff][COLOR=#0000ff]92796a8c6e61e8f1ee36e315c0acae7d /sdcard/download/gscript.zip[/COLOR][/COLOR]

note: you can also invoke the md5sum utility from an adb-launched shell:

C:\android\android-sdk-windows\tools>[B]adb shell[/B]
# [B]md5sum [COLOR=#0000ff][COLOR=#0000ff]/sdcard/download/gscript.zip[/COLOR][/COLOR][/B]
md5sum /sdcard/download/gscript.zip
[COLOR=#0000ff][COLOR=#0000ff]92796a8c6e61e8f1ee36e315c0acae7d /sdcard/download/gscript.zip [/COLOR][/COLOR]
# exit

Checking from Windows

Obtain the Windows Command Line version of an MD5 sum utility:

1. In the browser of your (Windows) PC, navigate to http://www.md5summer.org/download.html

2. About three-fourths of the way down the page, find the "DOS Command Line MD5sum utility".

3. Right-click and download this version (should be http://www.md5summer.org/md5sum.zip)

4. After downloading, extract the md5sum.exe file to your Android SDK's tools directory. That way, you'll have a home for all of the tools that you use for rooting.

5. To run it, just launch the Windows Command Prompt and change (cd) to your Android SDK's tools directory.

6. Type md5sum.exe c:\temp\gscript.zip

7. For example:

C:\Documents and Settings> [B]cd c:\android\android-sdk-windows\tools[/B]
C:\android\android-sdk-windows\tools>[B]md5sum.exe [COLOR=#0000ff][COLOR=#0000ff]c:\temp\gscript.zip[/COLOR][/COLOR][/B]
[COLOR=#0000ff][COLOR=#0000ff]\92796a8c6e61e8f1ee36e315c0acae7d *c:\\temp\\gscript.zip[/COLOR][/COLOR]

Checking from a Mac

Courtesy of doogald's post below:

Things are a bit easier from a Mac, since there is no utility that you need ro find or download. To check from the terminal on a mac:

- [optional] change directory to the location of the file for which you would like to check. For example, cd ~/Downloads

- use the openssl command to check, using the following syntax: openssl md5 pathtofile

For example, openssl md5 gscript.zip

 

[astrostrat89]

For windows users there is a applet here that you can just drag and drop a file onto. Stand alone app, no installs etc.

Vudu Gizmos

scroll down to "MD5" Lots of other cool stuff there too

 

[scary alien]

For windows users there is a applet here that you can just drag and drop a file onto. Stand alone app, no installs etc.

Vudu Gizmos

scroll down to "MD5" Lots of other cool stuff there too

astrostrat89,

Thanks for that! I downloaded and installed and tested MD5 with the same sample file...very nice interface to use! (and lots of other cool things I'm going to check out too). Appreciate this a lot (and I'm sure others will too!).

Also, I looked for a free Android app to use in place of running from the Android Terminal Emulator, but the one I tried (ManD5 Free) wasn't calculating the same MD5 checksum and eu1 published and I received using the various methods in the OP.

 

[thetingster]

I tried using Android Terminal Emulator from the market to get the md5 checksum from the gscript.zip file and when I entered the information from the original post I get the response "permission denied".

 

[McFluffnStuff]

There's an app called ManD5 that can do this.
ManD5 Full - Android app on AppBrain

There's also a free version.

 

[scary alien]

There's an app called ManD5 that can do this.
ManD5 Full - Android app on AppBrain

There's also a free version.

Well, I tried the free version and the sums that it returned didn't match the known values and that values that I calculated using other methods (all of the others matched--this one didn't).

 

[scary alien]

I tried using Android Terminal Emulator from the market to get the md5 checksum from the gscript.zip file and when I entered the information from the original post I get the response "permission denied".

That's odd...I tested this on my rooted Eris, but not su'd to root (as evidenced by the "$" prompt). I also tested this on my unrooted Droid X and it also worked from there.

Is this working for others using the Android Terminal Emulator?

tingster, can you post a screenshot? (by the way, are you sure you typed "md5sum" before the filename? i.e., "md5sum /sdcard/download/gscript.zip"...you will get "permission denied" if you omit the "md5sum" command).

 

[astrostrat89]

Vudu is a fairly powerful and easy scripting language to use (the debugger is awesome), the latest version is not documented. But I work with the guy who wrote it, and I've been pestering him to get on that.

 

[varkie]

won't work for me either using android terminal, get "illegal instruction". tried it su and without.

 

[scary alien]

won't work for me either using android terminal, get "illegal instruction". tried it su and without.

varkie,

Can you try /system/bin/md5sum /sdcard/download/gscript.zip from the Android Terminal Emulator (or some other file name to check the MD5 sum against). This will force an explicit reference to the native Android md5sum utility instead of possibly hitting the busybox version.

Thanks.

 

[KarateExplosion6]

Awesome! Glad to see that I can do it right on the phone (I've been verifying on Windows the entire time).

 

[varkie]

varkie,

Can you try /system/bin/md5sum /sdcard/download/gscript.zip from the Android Terminal Emulator (or some other file name to check the MD5 sum against). This will force an explicit reference to the native Android md5sum utility instead of possibly hitting the busybox version.

Thanks.

/system/bin/md5sum returns a message "not found", /sdcard/download/gscript.zip returns "permission denied"

 

[scary alien]

/system/bin/md5sum returns a message "not found", /sdcard/download/gscript.zip returns "permission denied"

varkie,

Thanks for trying...something is still odd to me...

Just to be clear, is this what you're typing at the "$" prompt in the Android Terminal Emulator?

[COLOR=blue][B]md5sum /sdcard/download/gscript.zip[/B][/COLOR]

 

[varkie]

varkie,

Thanks for trying...something is still odd to me...

Just to be clear, is this what you're typing at the "$" prompt in the Android Terminal Emulator?

[COLOR=blue][B]md5sum /sdcard/download/gscript.zip[/B][/COLOR]

yes, just tried it again, "illegal instruction".

 

[scary alien]

yes, just tried it again, "illegal instruction".

Okay, thanks again! I'm still investigating other options for doing this directly on the phone for those that this doesn't work on. I have a friend here at work that has a Motorola Cliq (1.5) that it doesn't work on either. It works on my rooted Eris (not su'd) and it works on my Droid X (not (yet) rooted).

I tried finding a Market app that would work, but I don't trust the one I found, so I'm going to try to write one myself (with help from jcase ).

Stay tuned.

 

[scary alien]

Hey guys, I've updated the first post to include details of an app that I developed that you can install and use directly on your phone to calculate MD5 or SHA1 checksums of any file on your phone (that you have access to).

Anyway, check it out and let me know what you think and/or if you have any problems or questions. Be gentle, this is my first app developed for Android .

Again, big props and thanks to jcase from XDA who let me view a sample project he developed with eclips3 and gave me some MD5 sum starter code to get me on my way. I would not have tried creating this without him being willing to help me out. He deserves lots of credit for not only helping me but all of the help he gives the Android community in general.

 

[doogald]

Checking from Windows

Things are a bit easier from a Mac, since there is no utility that you need ro find or download. To check from the terminal on a mac:

- [optional] change directory to the location of the file for which you would like to check. For example, cd ~/Downloads

- use the openssl command to check, using the following syntax: openssl md5 pathtofile

For example, openssl md5 gscript.zip

 

[scary alien]

Things are a bit easier from a Mac, since there is no utility that you need ro find or download. To check from the terminal on a mac:

- [optional] change directory to the location of the file for which you would like to check. For example, cd ~/Downloads

- use the openssl command to check, using the following syntax: openssl md5 pathtofile

For example, openssl md5 gscript.zip

doogald,

Thank you for that. I will include this in the OP. I plan on re-writing the first post to make it a little cleaner and incorporate this info and comments from erisuser1 about these checksum's value and meaningful use. Also, was it you that told me about (Windows) fciv (File Checksum Integrity Verifier)? I've got to go back and lookup this tool and include it too since it will also display SHA1 sums.

edit: yep, went back and did a quick search and you are (still) the man! thanks, info. and credit to you forthcoming in the top post.

 

[crz6662]

Just a quick question: Is there a way to repair an MD5 mismatch ? I have 5 Nandroid backups that I can't reinstall because of this.
Haven't finished researching yet but figured I'd ask anyway.
Thanks.

 

[erisuser1]

Just a quick question: Is there a way to repair an MD5 mismatch ? I have 5 Nandroid backups that I can't reinstall because of this.
Haven't finished researching yet but figured I'd ask anyway.
Thanks.

It is pretty unusual to experience a md5 mismatch - when it occurs, it means that something horrible has gone wrong: for instance, the file system of your SD card got corrupted, the SD card has developed some dead patches ( "bad blocks" ), or you corrupted/truncated one or more image files when restoring nandroid backups from your PC to your SD card.

In short, these are exactly the types of disasters that the use of checksums is there for - so that a bad situation is not made worse by restoring corrupted backups to your phone.

In general, the answer to your question is an emphatic "NO!" - the checksums does not somehow "save" information that got lost/changed, so that it can be magically recovered.

Now, the ".md5" file saved with each nandroid backup is just a plain text file, which could certainly be edited so that you are changing the checksum of one of the image files. So, the nandroid restore could be "tricked" into restoring a file, but you would never want to do this unless you were absolutely sure that the image file you were providing the checksum for was a valid, uncorrupted image file.

 

[scary alien]

+1 to the above ^^^

By the way, when the Nandroid backups are created, the script uses an "mdsum *img > nandroid.md5" command to create the checksum file that is used later by a Nandroid restore to verify that your files are intact.

Altering or rebuilding your nandroid.md5 file is certainly possible but should only be done, like erisuser1 said, if you are sure that the files and checksums you are "re-introducing" are proper. Like he said, having five Nandroids you can't restore points to a much larger problem.

 

[crz6662]

Interesting. So reading your guys posts sounds like I should reformat my SD card. 2 of the backups were only days old, so somethings up with the card or file system ? It's an 8GB Class 6, with approx. 2.5GB free.
Downloaded ScaryAlienWare Checksum Utility v2.1.
I'm assuming the following:
MD5 Checksum (hex)
Below that line a bunch of numbers in Green.
I see green in a bunch of files, & guess if it's in red it means it's a bad file ?

Everything else seems to run good on the card. Approx. 90+ apps installed on the card, approx. 1600 backed up to the card, about 2GB of music, some videos & some pics. 2.37GB free space. My only problem, which has only started within the last 3 weeks has been trying to restore my backups. Also, I do all this on the phone, nothing goes back & forth to the computer.

So what would my much larger problem be ?

Using ClockworkMod 2.5.0.1.

Rooted/Flashed G1
HTCClay's SuperFastG1 1.3RH - 1.6 Donut
77.86MB internal memory free
Fat32/Ext3

Have tried all various versions including BeatMod Gingerbread but keep coming back to this rom because of it's speed, instant opening, no/or the least, FC's and no phantom reboots.

Going to wait before I do anything till I hear from you guys.
Thanks.

 

[scary alien]

Interesting. So reading your guys posts sounds like I should reformat my SD card. 2 of the backups were only days old, so somethings up with the card or file system ? It's an 8GB Class 6, with approx. 2.5GB free.
Downloaded ScaryAlienWare Checksum Utility v2.1.
I'm assuming the following:
MD5 Checksum (hex)
Below that line a bunch of numbers in Green.
I see green in a bunch of files, & guess if it's in red it means it's a bad file ?

Everything else seems to run good on the card. Approx. 90+ apps installed on the card, approx. 1600 backed up to the card, about 2GB of music, some videos & some pics. 2.37GB free space. My only problem, which has only started within the last 3 weeks has been trying to restore my backups. Also, I do all this on the phone, nothing goes back & forth to the computer.

So what would my much larger problem be ?

Using ClockworkMod 2.5.0.1.

Rooted/Flashed G1
HTCClay's SuperFastG1 1.3RH - 1.6 Donut
77.86MB internal memory free
Fat32/Ext3

Have tried all various versions including BeatMod Gingerbread but keep coming back to this rom because of it's speed, instant opening, no/or the least, FC's and no phantom reboots.

Going to wait before I do anything till I hear from you guys.
Thanks.

crz6662,

Wow...been a while since I've even looked at my old "MD5 Checksum" app...there's a newer version available (free) in the Market: AFV (Android File Verifier) that has quite a few more features (but hey, an MD5 is an MD5, eh? ).

The text in green below the "MD5 Checksum:" line is indeed the checksum itself. I'm not sure about what the "in red" you are referring to (my app only calculates the checksum--it can't actually tell that the file is bad or not). My AFV app that I refererenced about has a feature where you can select the nandroid.md5 file in a Nandroid backup directory, long-press, and select "Verify Nandroid Backup" and it will cross-check the MD5 checksum of the files listed in the nandroid.md5 file. This is basically equivalent to the "md5sum -c" command which is what the Nandroid restore function will do prior to allow a restore operation to proceed.

Also, I'm just inferring here, but it sounds like you are not using an HTC Droid Eris. I say this because of the "G1" reference and the non-Eris ROMs that you mention.

I would hate to speculate further about what future course of action you might take given that its not an Eris...

I bow to erisuser1's much greater / vast experience (in most things, lol)...so, hopefully, he might have a suggestion or two...

Good luck!

 

[crz6662]

Thanks for the reply. I'll download the new version & check it out.
As far as the "in red", I just assumed if it was a good file, it's green, if it's bad, it's red. That's what I thought the app did, so you didn't install a corrupted file. I had already deleted all my backups so I couldn't do a check of those. I'm not understanding what good is knowing the MD5 checksum hex if I can't edit it, fix it or whatever. Not being a smart ass at all, just don't know. I'd appreciate any further explanation you could give me.
I'm still a bit lost as to what exactly the app does if it's not to tell me if a files good or not. What's the purpose ?
I'm far from an expert, that's why I listen/learn from guys like you, so thanks again for your time.

You are correct, I am not using a Droid Eris, I'm using the HTC Dream/T-Mobile G1. I know we're not talking the same phone but a lot of things with android can pertain to the system & not a particular phone. I'd say that's the case here though you might not be able to give me step by step instruction. I've gained more here than elsewhere.

When researching MD5 this is 1 of the sites that came up. This forum was actually 1 of the more helpful.

Will your new version tell me if I have a bad file ? Going to download now and see what she does.
Appreciate any more feedback. Thanks.

 

[scary alien]

Thanks for the reply. I'll download the new version & check it out.
As far as the "in red", I just assumed if it was a good file, it's green, if it's bad, it's red. That's what I thought the app did, so you didn't install a corrupted file. I had already deleted all my backups so I couldn't do a check of those. I'm not understanding what good is knowing the MD5 checksum hex if I can't edit it, fix it or whatever. Not being a smart ass at all, just don't know. I'd appreciate any further explanation you could give me.
I'm still a bit lost as to what exactly the app does if it's not to tell me if a files good or not. What's the purpose ?
I'm far from an expert, that's why I listen/learn from guys like you, so thanks again for your time.

You are correct, I am not using a Droid Eris, I'm using the HTC Dream/T-Mobile G1. I know we're not talking the same phone but a lot of things with android can pertain to the system & not a particular phone. I'd say that's the case here though you might not be able to give me step by step instruction. I've gained more here than elsewhere.

When researching MD5 this is 1 of the sites that came up. This forum was actually 1 of the more helpful.

Will your new version tell me if I have a bad file ? Going to download now and see what she does.
Appreciate any more feedback. Thanks.

You are most welcome! We like to think that AF is a pretty helpful site (and the Eris forums in particular ).

Having the MD5 checksum gives you a benchmark for comparing a file against in the future so that you know that a file is whole and uncorrupted.

It (and the myriad of other types of checksums like SHA1, CRC32, etc.) are just calculations done on a file (or string) in an attempt give it a unique "signature" (for lack of a more precise term in this context).

Using the Nandroid backups as an excellent example, the nandroid-mobile.sh script that is invoked by the custom recovery (ClockworkMod in your case) will, after creating the Nandroid backup files, calculate the checksums for each of the files made in the backup.

Then, when you go to actually restore these Nandroid backups, you would like some assurance (warm and fuzzies ) that the files are indeed in the same condition (size and content) as they were when the backup was created. The nandroid-mobile.sh script will, before performing a Nandroid restore operation, verify that the MD5 checksums still match the ones recorded in the nandroid.md5 file.

Having the newly-calculated MD5 checksum match the old / previously recorded checksum tells you that the file has not been modified.

Having them not match tells you that something has either modified the file or the checksum.

Does that help?

Cheers!