It accomplishes this by storing extended data on every important file in your system. It stores each file's size, mode, last modification time, and all the other major data in the inode. You run Tripwire whenever you want to check that no one has tampered with any of these files. Tripwire checks that database to look for changes to file meta-data. It also confirms that file contents haven't changed by re-computing the signature and comparing with its stored value.
Signatures have two essential properties.
First, a small change in the file contents produces a substantial change in the signature itself. The other essential property of these signature algorithms is that it is pratically impossible to generate two files with the same signature. Copyright 2001 INT Media Group, Incorporated All Rights Reserved.