On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.

How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?

I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.

  • I'm voting to close this question as off-topic, and not about infosec. An alternative would be to move it to superuser.com, but they'll likely close it as a dup of the above question. Dec 9, 2015 at 19:54
  • @NeilSmithline thanks for looking up some links, but I already know about the various timestamps in Unix and Linux. I'm more interested in how you would know if files had been changed, if an attacker tried to cover it up. Would that not fall under infosec?
    – Arronical
    Dec 10, 2015 at 9:20
  • It's a close call and others may disagree. If the answer involved IDs then it's infosec. But the answer is OS specific calls so it belongs there, IMO. Dec 10, 2015 at 15:00
  • If the ctime is newer than the atime or mtime then the file timestamps have been tampered with. Isn't that what you want? Note that there is no defense against a temporary clock reset. Dec 10, 2015 at 15:03

1 Answer 1


Host Intrusion Detection Systems (HIDS) can offer this feature : File integrity checking.

I don't try it personnaly but according to the documentation AIDE can do this.

The idea is to create hash values of the files you want to verify they don't change then compare them regularly with new calculated values.

  • Sounds like a good start, but I assume this has to be set up before I think that an intrusion has happened?
    – Arronical
    Dec 9, 2015 at 15:20
  • Yep. If you think it already happened and it's possible that the modified date was also changed, i think your system is heavily compromised and you should consider get your backups to recover from it. Dec 9, 2015 at 15:23
  • Fortunately this is a hypothetical situation. Just interested in data forensics and keen to know if there are any ways to check this retroactively.
    – Arronical
    Dec 9, 2015 at 15:26
  • 1
    No - there is no retrospective way to do this, you need a system set up to monitor intrusion, otherwise an attacker can change anything on the system
    – Rory Alsop
    Dec 10, 2015 at 14:55
  • 1
    @RoryAlsop There are retrospective ways to do this. Anomalies in the mtime and hidden crtime (not ctime) can give away whether a file was modified, but it's context dependent. You can also check the inode number and see if it makes sense (if the mtime implies the last modification was ages ago, yet the inode number is big enough that it must have been created recently, you know something is going on).
    – forest
    Nov 2, 2018 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .