I would use objects instead of raw hash indexes for this kind of thing. In which case, you may wish to look into Class::MethodMaker and it's object_list support, as well as writing a test suite that expresses what you want your code to do.

As an aside, are you sure it's worth the effort to write from scratch such a complicated tool that still will not really get you what you want?

I say this mostly because as a user-space solution any sort of file integrity checker will be vulnerable to kernel modules that hide the attackers files away from user-level view

Of course, if you're using this for simple file tracking then more power to you..