Baseline drift reports use both file content (its hash) and file location (its full pathname) to identify added, missing, and changed files. Advanced Options in Baseline Drift Report Details allow you to change how they use these factors.

  • File content – By default, baseline drift reports use the File content method for comparisons. When this option is in effect, if a file in the baseline has the same hash as a file in the target, no drift is reported, regardless of the pathname (location) of the two files. A file in the same location (that is, same path and filename on baseline and target) but with different hashes is considered modified on the target and so counts as drift. Baseline hashes not found anywhere on the target are reported as missing files, and target hashes not found on the baseline are considered added files.
  • File location – No drift is reported for the same hash found with the same path and filename on both baseline and target. Different hashes found at the same location (path and filename) are considered modified files and add to the drift number. And if the same hash is found in different locations, it is not considered a match. In that case, Baseline Drift Reports can report a new file (if the baseline had no file at the location where the file exists on the target), missing (if the target has no file where the baseline had one), or modified (if there is a file with the same name but a different hash on the baseline and target).

In some cases, the different comparison methods have no effect on total drift. This is likely if you activate tracking of missing files as part of the drift report. If you maintain the default setting and do not track missing files, the different comparison methods can produce different drift results, as shown in the following table.

Table 1. Example: How different comparison methods affect drift

Files in Baseline

Files in Target

Drift by content

Drift by Location

C:\folder1\file1(hash A)

C:\folder1\file1(hash A)

None

None

C:\folder1\file2(hash B)

C:\folder1\file2(hash F)

1 new (hash F)

1 changed (file2)

C:\folder2\file3(hash C)

C:\folder2\file3(hash B)

1 changed (file3)

1 missing (hash C)

C:\folder2\file4(hash D)

 

1 missing

1 missing

 

C:\folder2\file5(hash G)

1 new

1 new
Total Drift Including Missing Files 4 4
Total Drift Not Including Missing Files (default) 3 2