On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem.
How would I discover if files have been changed, but the modified times have been made to look like the files have not been tampered with?
I'm most interested in a way to check whether this has already happened, rather than using a tool which checks whether it happens from now on.