File Integrity Monitoring Tool (FIM)

A Python-based File Integrity Monitoring (FIM) tool that detects unauthorized modifications to files using SHA-256 cryptographic hashing. The tool establishes a trusted baseline for files and compares future scans against it to identify potential tampering.

This project was developed as a cybersecurity project to demonstrate the concepts of file integrity monitoring, cryptographic hashing, and log file tampering detection.

---

Features

• SHA-256 based file integrity verification
• Monitor a single file or an entire directory
• Initialize and store baseline hashes
• Detect:
  • Modified files
  • Newly added files
  • Deleted files
• Store additional metadata:
  • File size
  • Initialization timestamp
• Detect possible log truncation using file size comparison
• Generate timestamped integrity reports
• Color-coded terminal output for better readability
• Manual baseline update after legitimate changes

---

Technologies Used

• Python 3
• hashlib
• json
• argparse
• os
• datetime
• Colorama

---

Installation

Clone the repository:

git clone https://github.com/kansaraaryan-lab/File-Integrity-Monitor.git
cd File-Integrity-Monitor

Install the required dependency:

bash

pip install -r requirements.txt

---

Project Structure

File-Integrity-Monitor/
│
├── fileintegrity.py
├── hashes.json                 # Generated after initialization
├── requirements.txt
├── README.md
│
├── logs/
│   ├── example.log
│   └── example2.log
│
└── reports/                    # Generated automatically

---

Usage

Initialize a baseline

Stores SHA-256 hashes for all files inside the specified directory.

bash

python fileintegrity.py init logs

Example:

Stored hashes for 2 file(s).

---

Check file integrity

Compares current file hashes against the stored baseline.

bash

python fileintegrity.py check logs

Example:

[OK] logs/example.log: Status: Unmodified (128 bytes)

[MODIFIED] logs/example2.log: Status: Modified (Hash mismatch)

Previous Size : 128 bytes
Current Size  : 256 bytes

========== Scan Summary ==========
Scan Time  : 2026-07-12 23:41:25
Unmodified : 1
Modified   : 1
New Files  : 0
Deleted    : 0
Total      : 2

A timestamped report is automatically generated inside the reports/ directory.

---

Update the baseline

After making legitimate changes to files, update the stored hashes.

bash

python fileintegrity.py update logs

Example:

Updated logs/example.log
Updated logs/example2.log

Successfully updated 2 file(s).

---

How It Works

1. Reads every file from the specified directory.
2. Computes a SHA-256 hash for each file.
3. Stores hashes and metadata in hashes.json.
4. During future scans:
   • Recomputes hashes.
   • Compares them with the stored values.
   • Detects modifications.
   • Detects newly created files.
   • Detects deleted files.
   • Compares file sizes to identify possible log truncation.
5. Generates a detailed integrity report after every scan.

---

Example Report

========================================
        FILE INTEGRITY REPORT
========================================

Scan Time:
2026-07-12 23:41:25

logs/example.log
UNMODIFIED

logs/example2.log
MODIFIED

========================================
              SUMMARY
========================================

Unmodified : 1
Modified   : 1
New Files  : 0
Deleted    : 0
Total      : 2

---

Future Improvements

• Support additional hashing algorithms (SHA-512, BLAKE2)
• Continuous file monitoring using Watchdog
• SQLite database for hash storage
• Digital signature protection for the hash database
• GUI interface
• Email alerts for detected tampering
• Ignore/include configuration files

---

Disclaimer

This project is intended for educational purposes and demonstrates the principles of File Integrity Monitoring (FIM). It is not intended to replace enterprise-grade security monitoring solutions. This project idea was inspired from https://roadmap.sh/projects/file-integrity-checker, where along with their requirements, I have added many more features in this FIM.

---

License

This project is released under the MIT License.