File Integrity Verification Using Cryptographic Hashing: A Review Of Hash Functions, Keyed Hashes, Merkle Trees And Integrity Monitoring Systems

Files on computers, servers and cloud storage can be altered by malware, intruders, faulty hardware or insiders, often without visible signs. File integrity verification detects such changes by computing a cryptographic fingerprint of each file and comparing it with a trusted reference. This paper reviews the cryptographic foundations and system designs for file integrity verification. It explains the properties of cryptographic hash functions, namely preimage, second-preimage and collision resistance, and examines the families in use, including the deprecated MD5 and SHA-1, which suffered practical collisions, the SHA-2 family and faster modern designs such as BLAKE2. Keyed-hash message authentication codes and digital signatures are reviewed as means of protecting stored hashes from attackers who could otherwise recompute them. Merkle hash trees for efficient verification of large file collections, file integrity monitoring tools, kernel-level integrity measurement and transparency logs are discussed. A five-layer architecture comprising file discovery, hashing, protected baseline storage, scheduled and event-driven verification, and alerting with response is proposed, together with research gaps, objectives, a comparison of hash algorithms and challenges such as legitimate updates, performance on large files and baseline tampering. The review concludes that strong hashes combined with protected baselines provide reliable tamper detection.