SHA-256 Check: Did a File Change After Copying?

You have moved a website archive to another drive: its name and size look right, but is the content still the same? A SHA-256 check helps compare the bytes of two files without extracting or executing their contents. In this training exercise, we will use small text files, obtain a match and then deliberately modify the copy. This demonstrates not only a successful result but also whether the check actually detects a difference.

The goal is limited to integrity during copying. Matching checksums do not prove that a backup contains the required database, that the application will restore successfully or that the source is trustworthy. We will not use real client archives, connect to a server or upload anything to third-party services. This is a local exercise, not a report on a verified AriZone backup.

Choose the reference before calculating a checksum

The comparison needs two specific versions: a completed original and its copy after transfer. If a file is still being written, the result may describe intermediate content. Wait for export and copying to finish, and make sure neither file is changing anymore. Do not use a live database file instead of a consistent export: identical bytes and a snapshot suitable for restoration are different requirements.

For the exercise, create a new test directory outside the website’s public directory. Save original-demo.txt there with any fictional sentence, then make an exact copy named copy-demo.txt using your file manager. Do not open and resave the copy before the first comparison: an editor may change its encoding or line endings. These names are examples; if you choose different ones, update the command too.

You need a configured Python 3 interpreter, a terminal and permission to read both files. No external packages or administrator privileges are required. Use an interpreter that is already available; do not change the system Python or permissions on working archives for this exercise. If the material contains personal data, work only in authorised private storage and do not publish its contents or full private paths in support requests.

Read the files as bytes and compare the result

In the same directory, create a new file named compare-copy.py containing the following code. The hashlib module belongs to the standard library; sha256, update and hexdigest are described in the official Python documentation. The program reads files in blocks rather than attempting to load an entire archive into memory. It does not extract, execute or overwrite either input file.

import hashlib
import sys

def digest(path):
    result = hashlib.sha256()
    with open(path, "rb") as source:
        for block in iter(lambda: source.read(65536), b""):
            result.update(block)
    return result.hexdigest()

if len(sys.argv) != 3:
    raise SystemExit("Usage: compare-copy.py ORIGINAL COPY")

try:
    original = digest(sys.argv[1])
    copied = digest(sys.argv[2])
except OSError:
    raise SystemExit("READ_ERROR")

print("original:", original)
print("copy:    ", copied)
print("MATCH" if original == copied else "MISMATCH")
raise SystemExit(0 if original == copied else 1)

The rb mode matters: the comparison uses actual bytes, without decoding text or normalising line endings. Even if two documents look identical in an editor, their encoding or control characters may differ. In contrast, the filename and modification time do not participate in this calculation. Do not treat matching checksums as a check of file permissions, ownership or the correct storage location.

In the terminal, move to the directory containing all three files and run the command below. The first argument is the reference and the second is the copy; put quotation marks around each path that contains spaces. The command only reads these files. Reading large archives creates disk load, so do not schedule bulk execution on a production server alongside demanding operational workloads.

python3 compare-copy.py original-demo.txt copy-demo.txt

For an exact copy, expect identical hexadecimal strings and the message MATCH; the exit code will be zero. A difference produces MISMATCH and exit code one. If a file is missing, is actually a directory or cannot be accessed, the program stops with READ_ERROR: that is a reading error, not proof of a damaged copy. Do not change permissions blindly; check the path, object type and access you are authorised to use.

Demonstrate that the check notices a change

After the first successful comparison, open only the training file copy-demo.txt, add one character and save it. Repeat the same command: now expect MISMATCH. Leave the original untouched. To restore the initial test, create a fresh exact copy of the original in your test directory, agreeing to replace only this training file. Do not repeat this exercise with a real archive that is your only backup version.

Separately test two empty training files: they also produce MATCH. This is precisely why a successful comparison does not prove backup completeness. For each attempt, record the test filenames, action, expectation and actual result. When checking many copies, do not provide the same path twice: comparing a file with itself does not confirm a successful transfer.

Do not explain every MISMATCH as an attack. First check whether the same export was selected, whether the archive was repackaged and whether downloading finished. Repackaged archives may contain the same documents while their container bytes differ. Our method checks exact copying of a completed file, not the logical equivalence of two independently created backup sets.

If the original is not available locally, you need a checksum obtained from a trusted source through a separate verified method. The program above compares two files and does not implement signature verification or verification of such a manifest. A text file containing a hash downloaded alongside an unknown archive does not establish authorship by itself. Do not replace origin verification with simply calculating the same checksum again.

In conclusion, a checksum is useful as a narrow check that a completed file has not changed. Afterward, verify the backup’s contents and perform a test restoration under your own plan. For the broader process, see the WordPress backup article (in Ukrainian). If you are unsure where copies lose integrity, AriZone can help separate creation, transfer and verification and prepare a safe sequence of checks.