It depends on my trust level of the thing in question. If I'm spot checking if a customer tampered with a file on their deployment usually the first or last 4-

It depends on my trust level of the thing in question. If I'm spot checking if a customer tampered with a file on their deployment usually the first or last 4-6 characters. Because it's unlikely they were attempting to forge access to their own system. If I'm checking something I reasonably trust because I downloaded it over ssl from a proper source like a CentOS iso and there's no sum file. I'll check first 4-6, last 4-6 and find a 4-6 characters in the middle and scan for that sequence too. If it's something I can have zero trust like getting something from a torrent site I'll paste one right below the other because side by side is a bad way to do it.