The copy finished. 1TB, thousands of files, no errors reported, sizes match. It is tempting to call that verified — but file sizes and counts prove only that something of the right shape arrived. Silent corruption, a glitchy cable, a drive with marginal sectors: all can deliver files that look right and are wrong inside.
A SHA-256 checksum comparison settles the question definitively. Hash every file on the source, hash every file on the destination, and compare. Identical hashes mean identical bytes — mathematically, not hopefully. Here is how to do it for a terabyte-scale copy without losing your mind.
Quick Answer
On the source drive, generate a checksum manifest: a text file listing every file’s SHA-256 hash and path, using PowerShell’s Get-FileHash in a recursive loop. Copy that manifest to the destination, then run a verification pass that re-hashes the destination files and compares them against the manifest, reporting any mismatch or missing file. Tools like TeraCopy with its verify option, or FreeFileSync’s checksum comparison, automate the same idea. Expect the hashing to take hours — it reads every byte twice.
What a Checksum Proves (and What It Does Not)
SHA-256 reads a file’s entire contents and produces a 64-character fingerprint. Change one byte anywhere — one pixel, one letter — and the fingerprint changes completely. Matching fingerprints between source and destination therefore prove the copy is byte-for-byte identical. What checksums do not prove is that the source itself was healthy; hashing a corrupt file faithfully copies the corruption and verifies it beautifully. Verification answers “is the copy identical to the source?” — a separate question from “was the source good?”, which is what the decode checks in our guide to checking recovered files for corruption automatically address.
Method 1: PowerShell Manifest (Built Into Windows)
- Build the manifest on the source. Open PowerShell in the source folder and run a loop over all files:
Get-ChildItem -Recurse -File | ForEach-Object { $h = Get-FileHash $_.FullName -Algorithm SHA256; "$($h.Hash) $($_.FullName.Substring($PWD.Path.Length+1))" } | Out-File -Encoding utf8 manifest.sha256. Relative paths matter — they let the same manifest verify the copy anywhere. - Wait. Hashing 1TB means reading 1TB. On a fast SSD that is under an hour; on a spinning external drive, several hours. Let it run undisturbed.
- Copy the manifest file to the destination folder’s root.
- Verify on the destination. A companion loop reads each manifest line, hashes the corresponding destination file, and reports OK or MISMATCH. Even a simple version that lists mismatches and missing files is enough; review the output before trusting the copy.
- Save the manifest with the data. It becomes the archive’s birth certificate — future checks compare against it to detect bit rot years from now.
Microsoft documents Get-FileHash and the related CertUtil tool across the Get-FileHash reference on Microsoft Learn — CertUtil’s -hashfile command is handy for hashing a single file quickly when a whole manifest is overkill.
Method 2: Let a Copy Tool Verify as It Goes
If the copy has not happened yet, tools can combine copying and verifying. TeraCopy has a verify option that hashes each file after copying and compares it to the source hash — slower than a plain copy, but the job ends proven. FreeFileSync can compare folder contents by file content (checksum) rather than size and date, which effectively audits an existing copy pair. Robocopy, despite its strengths, does not hash — it compares sizes and timestamps only, so it cannot certify a copy’s contents. For a 1TB archive move, running the copy with a verifying tool from the start is the least total work.
Timing and Practicalities
Budget honestly: the verification reads the full terabyte at least once more, twice if you build the manifest after copying (source read + destination read). Drives are the bottleneck — a USB 2.0 connection turns this into a multi-day sentence, so use USB 3 or faster and direct ports, not hubs. Run it overnight, disable sleep on the PC, and do not use the destination drive for anything else mid-verification. If the set is too large to verify in one pass, verify folder by folder and keep a log — partial verified beats wholly assumed.
Common Mistakes to Avoid
- Comparing only file counts and total size. A swapped or silently corrupted file passes both tests. Content comparison is the entire point.
- Using absolute paths in the manifest. The manifest then only verifies on the original machine layout. Relative paths make it portable to the destination and to future drives.
- Hashing the destination while it is still being written to. Verification after the copy fully completes — including any sync tools that might still be touching files.
- Ignoring a small number of mismatches. Even two mismatched files in 1TB mean the pipeline glitched, and the cause (cable, port, drive) may still be active. Investigate, re-copy those files, re-verify.
- Deleting the source before reading the verification report. The report is the permission slip for deletion. No report, no delete.
When the Copies Disagree Later: Bit Rot and Re-Verification
Verification is not only for moving day. Drives sitting in drawers lose data quietly — a sector here, a flipped bit there — and a file can rot in place while its name, size and date all stay perfect. This is why the manifest you built for the copy deserves a permanent home beside the data: re-run the verification against it once a year and any silent change announces itself as a mismatch while your other copy is still healthy. When a mismatch does appear years later, the healthy copy wins: re-copy the file from the verified-good source, re-hash, and confirm the repair. If both copies have somehow rotted in the same file (rare, but the reason archivists keep three copies), the decode checks described elsewhere in this guide series tell you whether the damage is visible or merely technical.
Treat the mismatch count as a drive health gauge, too. One mismatch in a year is an incident; a growing count across checks is a drive announcing its retirement. Replace it on your schedule, with a verified copy, rather than on its schedule, with a recovery bill.
Store the finished manifest in more than one place: with the destination data, with the source, and somewhere tiny and separate like an email to yourself or a cloud note. A manifest lost is a verification that must be rebuilt from scratch; a manifest kept is a permanent, portable answer to the question “is this copy still good?” for every future drive this data ever lives on.
Conclusion
A 1TB copy is verified when every file’s SHA-256 fingerprint matches the source’s — not when the progress bar reaches 100%. Build the manifest once, verify against it, keep the manifest with the data for future bit-rot checks, and you can delete the source or shelve the backup with genuine confidence instead of hope.
Frequently Asked Questions
How long does hashing 1TB take?
From under an hour on a fast internal SSD to most of a day over a slow USB 2.0 external drive. The drive and connection are the limits, not the CPU, on any modern machine.
Is SHA-256 overkill? Would MD5 do?
MD5 is faster and fine for detecting accidental copy glitches, but SHA-256 is the modern standard, costs little extra time when drives are the bottleneck, and produces a manifest that stays meaningful for decades. Use SHA-256 for archives.
One file mismatched. Is the whole copy bad?
No — it means that one file differs. Re-copy that file, re-hash it, and investigate the cause if more mismatches appear. A handful of mismatches usually traces to a specific glitch, not total failure.
Can I verify a copy made months ago?
Yes, if you still have the source: build the manifest there and verify the copy against it. If the source is gone, hashing the copy now still helps — the manifest becomes the baseline for detecting future changes.
Does Windows have a built-in checksum tool?
Yes: PowerShell’s Get-FileHash and the CertUtil command both compute SHA-256 with no downloads. For folder-scale work you wrap Get-FileHash in a loop, as this guide shows.
Leave a Reply