Is it possible or normal that the hash value of a file changes just after the first opening/execution of it?

I used sha256sum function within Ubuntu terminal to check the hash values before and after the opening/execution of the file.

The file has a hash value just after being downloaded (before first execution/opening); and has another hash value just after the first closing it.

The type of the file is PDF.


Yes, a program can change a file intentionally or accidentally(ie a bug). There's nothing preventing that assuming it has write permissions, even if you're only opening/closing it. And that will, of course, change the hash value. You can run diff <(xxd pdf_just_downloaded.pdf) <(xxd pdf_just_opened.pdf) to see the byte changes between the two versions

I haven't been able to replicate your issue on Ubuntu 18.04.

| improve this answer | |
  • Thanks for the diff command & the insight about how a program can do such things using it's write permission. – FoEvLe Jun 25 '19 at 19:06

Unless the content of the file changes in any way, it is not possible. Hashing algorthims rely on the content of the file to determine the hash of the file.

Unless the file has changed its own content upon execution, or you have written to the file in some way (even metadata within the file itself), then the hash will not change. One flipped bit in a file will cause an entirely new hash in a secure hashing algorithm.

In short - if you see a different hash, the file's contents have changed, even if it is by one bit.

| improve this answer | |
  • Thanks but the problem is exectly this: I tried several times... I just download the file from a source on the web, calculating the hash before opening it, then open it and close it immidiately; and then calculating the hash again... and two hashes are not equal... Is there any possibility for ubuntu himself to change something or do something to opening files? Or the softwre; in this case Document Viewer?... I know the basics of Hashing & how it works so am confused about this problem. – FoEvLe Jun 25 '19 at 18:20
  • What file are you opening - if it's publicly available - and are you just using the default Document Viewer? I suppose it's possible for a file viewer, by default, to add metadata to a file if opened in edit mode as opposed to read-only mode. Regardless - the file is certainly being changed - but most likely by you on edit. – AbsoZed Jun 25 '19 at 18:36
  • It is on cloud and not publicly available and Yes; the default document viewer. I just tested the problem using an online hash calculator to ensure that the hashing process has not any problem and as a result, the before/after hash values aren't equal. – FoEvLe Jun 25 '19 at 18:44
  • You're definitely editing it somehow. Try using cat instead via the terminal, and note how it does not change the hash. – AbsoZed Jun 25 '19 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.