Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am writing a script for Mac OS X Lion 10.7 and I would like to know how I can search for files based on their SHA1 hashes. I would like to search the whole file system for the file(s) I will be looking for.

For example the SHA1 value 0d882ff2d5edd7d045c1b57320d2e046793868f8 corresponds to the file MacOSXUpdCombo10.7.2.dmg How can I search the hard drive for the file with its SHA1 value without needing to compare the file?

share|improve this question

You can use the find command:

find / -type f -exec md5 {} \; | grep 0d882ff2d5edd7d045c1b57320d2e046793868f8

However, since you're running this on all files, it may be extremely slow — try limiting the search directory by replacing / with the path to a specific directory you want to search.

share|improve this answer
thanks! i was trying to search with shasum -facepalm- – Bryan Larson Mar 28 '12 at 20:37
You'll need to prefix that with sudo if you want the find to reach in to areas of the file system normally off limits to regular users. – Ian C. Mar 28 '12 at 20:54
@BryanLarson if this answer solved your question you should click the check mark under the vote count on the left there to accept yet. – Ian C. Mar 29 '12 at 19:56
The md5 will fail to match a sha1 hash. – daniel Azuelos Dec 12 '15 at 16:38

Here are a few lines of command which may help find a file from its SHA1 digest. Let's say the file we are hunting is MacOSXUpdCombo10.7.2.dmg.

# store the size of the searched file
size=`/bin/ls -l MacOSXUpdCombo10.7.2.dmg | awk '{print $5}'`
# store the digest of the serached file
sha1=`/usr/bin/openssl sha1 MacOSXUpdCombo10.7.2.dmg | awk '{print $2}'`
/usr/bin/sudo find / -type f -size ${size} -exec /usr/bin/openssl sha1 {} \; |
    grep ${sha1}

This find will run on plain files and not directories, socket or special files. It will also only run on file of the right size thus avoiding to make a digest of the Kernel or your iTunes library and on a flock of tiny temporary files.

If you are sure that the file name is including the right extension, this find might be accelareted further with the following argument list:

/usr/bin/sudo find / -type f -name "*.dmg" -size ${size} -exec /usr/bin/openssl sha1 {} \; |
    grep ${sha1}
share|improve this answer

You may also want to try using xargs depending on how many files you will be searching through.

find / -type f |
    xargs -I {} openssl sha1 {} | 
    grep 0d882ff2d5edd7d045c1b57320d2e046793868f8
share|improve this answer
openssl will still be called once per file thanks to the -I option of xargs, so there won't be any gain. – patrix Apr 23 '12 at 20:18
My apologies, you are correct I have edited my original statement. – E1Suave Apr 23 '12 at 20:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.