shellext / Recursive Hash

Recursive Hash

Recursive Hash (frmRecursiveHashFiles) is the recurse-into-subfolders variant of Hash Files. Same listview, fewer right-click options, and one feature unique to this view: Flatten to Hash, which copies a deeply-nested file tree into a single flat folder named by hash.

Two ways to reach it:

You can also drag a folder onto the path field at the top, or type/paste a path, then click Hash Files Below.

Listview

Columns: Hash, Size, File. Hash respects the global Use SHA256 setting (set in Hash Files → Options or in the shellext configurator). Size is hex-encoded raw byte count. File is the full path under the root.

The size column uses hex deliberately — many right-click reports re-emit it that way (see Flatten to Hash's index.txt below), and round-tripping decimal ↔ hex through the listview was a source of bugs in earlier versions.

Right-click: Copy

ItemOutput
HashsOne hash per line, plus a header line naming the source folder.
SqlOpens the SQL Export dialog with this listview as the source.
CSV Resultshash,hexSize,path CSV with header.
ReportAsks "one item per line?". Yes: single-line-per-file, padded for readability. No: three lines per file (File:, Size:, MD5:).

Right-click: actions

ItemAction
VT → Lookup AllBuilds a hash,path list, puts it on the clipboard, and launches virustotal.exe /bulk.
Strings for AllFor every row, runs frmStrings.ParseFile + AutoSave. Files with names already prefixed str_ are skipped. Reports total dumps generated and error count when finished.
Make all Ext SafeSame as the Hash Files version — appends _ to executable extensions so Explorer won't run them.
Flatten to HashSee below.

Flatten to Hash

The marquee feature of this dialog. Folder picker, then for every row in the listview:

  1. Re-hash the file (in case the global hash setting changed since the listview was populated).
  2. If the hash hasn't been seen yet in this run, copy the file to <destination>\<hash> — the file's new name is its own hash, with no extension. Bump that hash's hit count to 1.
  3. If the hash has been seen, just bump its hit count and don't copy.

Result: the destination folder contains exactly one copy of every unique file from the source tree, named by hash, plus an index.txt with one row per unique file:

Hits,Size,File,Hash,Type
   3,   12 KB,  loader.exe,  a1b2c3...,  Compiled: 2024-04-12 ...
   1,   45 KB,  helper.dll,  d4e5f6...,  Compiled: 2024-04-12 ... DLL

Hits is how many copies existed in the source tree; the Size column is human-readable; File is the original name of the first occurrence (the one actually copied); Type is the standard GetCompileDateOrType output. index.txt opens in Notepad when the operation finishes.

Useful for collapsing collections of malware samples that have been duplicated under many names — a "20,000-file" sample folder from a colleague often turns out to be 200 unique binaries with each renamed 100 ways.

See also