A lightweight, robust File Integrity Monitor (FIM) built in Python to detect unauthorized modifications, additions, and deletions using SHA-256 cryptographic hashing.
HashGuard is a security utility designed to monitor critical directories for file tampering. By creating a cryptographic baseline of your files, HashGuard can instantly spot when a file's contents have been altered, when a new file has been introduced, or when an expected file has gone missing.
It utilizes efficient chunked binary reading to handle files of any size without exhausting system memory, and persists baseline records securely using structured JSON.
- Cryptographic Hashing: Utilizes the SHA-256 algorithm to generate a unique 64-character signature for every file.
- Memory-Efficient Processing: Reads files in 4096-byte chunks (
4KB) to safely process large files without overloading RAM. - Recursive Directory Traversal: Automatically scans target directories and all nested subfolders using
os.walk. - State Persistence: Automatically saves and loads historical baselines using clean, human-readable JSON serialization.
- Comprehensive Audit Engine: Detects and categorizes three distinct security states:
- Deleted: Files present in the baseline but missing from the current directory scan.
- Modified: Files where the path matches, but the new content hash differs (tampering detected).
- Added: New files introduced to the directory that were not part of the original baseline.
HashGuard/
├── monitor.py # Core script containing hashing, baseline, and audit logic
├── baseline.json # Serialized JSON storage containing historical file signatures
└── test_folder/ # Monitored directory containing your sample target files
├── app_config.txt # Monitored configuration file
└── note.txt # Monitored note/text file