We’re rewarding the question askers & reputations are being recalculated! Read more.
2 Clarified question
source | link

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.

1
source | link

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?