The minimal set is to use full content of the file.<p>Consider the case of a log file and its backup made one short log message earlier.<p>If you want to gamble on using only a partial hash, I would hash the last few kb of each file, as that (at least based on this 30-second &#x27;analysis&#x27; of the problem domain) likely would work better in practice. Theoretically, it is as vulnerable, though.<p>Edit: if you have a VM image on your disk, and that small append happens to a log file in the image, that small change can happen anywhere. It also can be even smaller; someone might run &#x27;touch&#x27; on an already existing file. Theoretically, that could be a one-byte change.