Install md5deep with Homebrew, dnf, MacPorts, zypper, apt, Nix

Project links

• Homepage
• Upstream docs
• Package manager page

Commands and aliases

• hashdeep
• md5deep
• sha1deep
• sha256deep
• tigerdeep
• whirlpooldeep

Project history

The upstream NEWS file traces the project to version 0.12 on 2002-11-01, described as the first internally published version, with md5sum compatibility switches and initial documentation cleanup. Version 1.0 followed on 2004-03-15 with hierarchy traversal moved into `dig.c`, symbolic-link handling, standard-input support, expert mode, NSRL import fixes, and better error handling.

The project expanded from md5deep into a broader forensics-oriented hashing suite. NEWS records SHA-1 support in 2004, SHA-256 in 2004, Whirlpool in 2005, Tiger in 2005, and the `hashdeep` program in 2008 for multihashing and hash-file auditing.

Version 4.0 in 2012 was a major rewrite: the NEWS file says most of the program was rewritten in C++, multiprocessor support was enabled on all platforms, and many bugs were fixed. The README notes that the package still has historically different options and features depending on whether it is invoked as `hashdeep` or `md5deep`.

Adoption history

The supplied package-manager metadata shows the suite distributed by Homebrew as `md5deep`, by Debian/Ubuntu and Nix as `hashdeep`, and by Fedora, MacPorts, and openSUSE under related package names. That cross-distro packaging reflects its long-standing role in Unix file-integrity and digital-forensics workflows.

The tool family survived partly because it is scriptable and format-oriented: it can generate recursive hash manifests, load known-hash files with `-k`, and audit a directory with `hashdeep -a`.

How it is used

Common usage is recursive hashing of directories and files, then comparison against known hash sets. The README demonstrates generating an audit file with `hashdeep -r dir > /tmp/auditfile` and later checking it with `hashdeep -a -k /tmp/auditfile -r dir`.

The suite installs several algorithm-specific command names, including `md5deep`, `sha1deep`, `sha256deep`, `tigerdeep`, and `whirlpooldeep`, plus the broader `hashdeep` interface.

Why package nerds care

For package-history people, md5deep/hashdeep is a classic example of a small command-line utility becoming infrastructure for incident response, disk imaging, and reproducible file inventories. Its NEWS file documents the path from a recursive md5sum-compatible tool to a multi-algorithm auditing suite.

It also shows how Unix package names can preserve history: Homebrew still packages `md5deep` while other ecosystems expose `hashdeep`, even though the modern README frames the repository as hashdeep.

Timeline

• 2002-11-01: Version 0.12 first internally published.
• 2004-03-15: Version 1.0 released with traversal, symbolic-link, stdin, and expert-mode improvements.
• 2008-05-10: Version 3.0 added the `hashdeep` program for multihashing and auditing.
• 2012-01-06: Version 4.0 rewrote most of the program in C++ and enabled multiprocessor support.
• 2014-01-29: Version 4.4 added case-insensitive auditing and command-line checks.

Related projects

• The README lists MD5, SHA-1, SHA-256, Tiger, and Whirlpool as the supported algorithms.
• The NEWS file references interoperability with NSRL, EnCase hash sets, Hashkeeper, and iLook-style hashes.

Sources

• https://github.com/jessek/hashdeep#readme
• https://github.com/jessek/hashdeep/blob/master/NEWS
• https://github.com/jessek/hashdeep/tree/master/man
• source_facts.package-manager