Linux: How to display the latest files modified by a hacker

Sometimes it is important to know if the files on your server are modified by a hacker, or see what has been changed on a system after an abnormal behavior, or to check if you are a victim of piracy.

There is a solution to remedy this. It consists to list all files modified in a specific directory within 2 days thanks to the Linux find command:




find /directory -type f -mtime -2 -print | more

The problem with this command is that you must check per-directory. That's why it is best to look in all the server with the following command:

find / -not -path '/sys*' -not -path '/dev*' -not -path '/proc*' -mmin -30 

Here, we exclude directories / sys / proc and / dev then indicates that one wants only files modified in the last 30 minutes.

Remember that the best support for this blog is to like and share our articles! 😉

• Tweet
• Share
• Share
• Share
• Share

About AMINE

I founded the Blog DepoTech in January 2015. Self-taught in development, I have always pushed my curiosity about the topics,Web and Tech news.

Related Post