It sounds like you just need to sign each file and store a db of all the signatures so you can verify them later. Unless you think you need to go through and do format verification of each file to ...