How to find out a file's SHA-256 hash
You may need a file's SHA-256 hash to confirm that the file hasn't changed.
If the file has not been detected by Sophos, you can use the Sophos Endpoint Self Help tool, which is installed on every Sophos Central endpoint.
If the file has been detected by Sophos, use the event details in Sophos Central, as follows:
- Go to Devices. and click
- On the Computers page or the Servers page, find the device on which the file has been detected and click the device name.
- Click Events.
-
Find the detection event (not the cleanup event).
- If there is a Details link next to the
event, click it to show Event details.
Here you can see the SHA-256 hash.
- Otherwise, check if a threat case has been created for the detection. This shows the SHA-256 hash of any processes involved.
- If there is a Details link next to the
event, click it to show Event details.
Here you can see the SHA-256 hash.
If you cannot find the hash or have any questions, contact Sophos Support.