Hi

MD5, SHA-1 an other hashes take the whole file as an input.
Make a test: Create a MD5 hash of a huge file (like 650 MB),
change one char using a hex-editor, and create a new MD5 hash.
Any difference?

In fact, hashes are one part of the database, Tripwire creates.
Thus, it is very easy to create a Tripwire-like program:

- create a table like "filename MD5-hash SHA1-hash"
using a trusted MD5 and SHA1 generator.
- store this table on a very secure and different machine or burn
the table and generators on read-only media.
- recreate the table from time to time using trusted hash
generators and check for differences.

/edit: note, that one crucial ingredient of hashing-algorithms is
to create completely different hashes, even if the initial files are
very similar. I predict that the two MD5 hashes of this huge file
are completely different, even if you only change one char out
of ~650 Million! This is one reason, why MD5 and SHA1 became
standard.

Cheers.