I'm afraid you'll need to provide more information. An array of arrays, an array of hashes, a hash of arrays, a hash of hashes, or any arbitrarily complex datastructure can be created all using references. But the datastructure should probably be a natural extension of the data you're working with, and I'm afraid you haven't told us what exactly that is going to be.

But we can provide you some good startingpoints. Start with perlreftut (tutorial on Perl references), and perlref (in depth explanation of Perl references). Then move on to reading perldsc (the Perl Datastructure Cookbook) and perllol (Perl lists of lists discussion). Those documents will prepare you for making an informed decision on what datastructures to use, and how to manipulate them.

I would use objects instead of raw hash indexes for this kind of thing. In which case, you may wish to look into Class::MethodMaker and it's object_list support, as well as writing a test suite that expresses what you want your code to do.

As an aside, are you sure it's worth the effort to write from scratch such a complicated tool that still will not really get you what you want?

I say this mostly because as a user-space solution any sort of file integrity checker will be vulnerable to kernel modules that hide the attackers files away from user-level view

Of course, if you're using this for simple file tracking then more power to you..