How to search for a file by a hash value with bash script (terminal)?

You can use the find command:

find / -type f -exec sha1sum {} \; | grep 0d882ff2d5edd7d045c1b57320d2e046793868f8

However, since you're running this on all files, it may be extremely slow — try limiting the search directory by replacing / with the path to a specific directory you want to search.


You may also want to try using xargs depending on how many files you will be searching through.

find / -type f |
    xargs -I {} openssl sha1 {} | 
    grep 0d882ff2d5edd7d045c1b57320d2e046793868f8

Here are a few lines of command which may help find a file from its SHA1 digest. Let's say the file we are hunting is MacOSXUpdCombo10.7.2.dmg.

# store the size of the searched file
size=`/bin/ls -l MacOSXUpdCombo10.7.2.dmg | awk '{print $5}'`
# store the digest of the serached file
sha1=`/usr/bin/openssl sha1 MacOSXUpdCombo10.7.2.dmg | awk '{print $2}'`
/usr/bin/sudo find / -type f -size ${size} -exec /usr/bin/openssl sha1 {} \; |
    grep ${sha1}

This find will run on plain files and not directories, socket or special files. It will also only run on file of the right size thus avoiding to make a digest of the Kernel or your iTunes library and on a flock of tiny temporary files.

If you are sure that the file name is including the right extension, this find might be accelareted further with the following argument list:

/usr/bin/sudo find / -type f -name "*.dmg" -size ${size} -exec /usr/bin/openssl sha1 {} \; |
    grep ${sha1}