My gut feeling has always been that I distrust comparing things only by their hashes.

http://valerieaurora.org/review/hash/node9.html

When I wrote my lame home-grown backup-dedup system, I used MD5_lengthinbytes instead of just MD5 hardy har har. Fortunately since I use it mainly for family photo backups I guess I'm less likely to have a malicious file.

http://valerieaurora.org/hash.html