What checksums can and cannot verify
A hash is calculated from file bytes. Compare with a trusted expected value using the same algorithm, separately from content inspection and sender verification.
Key point
Byte consistency, file completeness, content correctness and source trust require separate checks.
Define the comparison
Record the file version and algorithm. Matching cryptographic hashes such as SHA-256 provide strong evidence of identical bytes; names, locations and external timestamps need separate checks.
Check completeness too
One hash cannot check omitted sidecars or external data. List required files and their values and check missing or extra items. Line endings or recompression can change hashes; semantic equivalence is a separate test.
Not proof of origin or safety
An attacker replacing both file and expected hash can defeat comparison. Verify the expected value's source and signatures when required. A match does not prove correct measurements, complete originals or absence of malware. Preserve originals and investigate mismatches.