4

On 16/05/2015 at 17:18 I visited a malicious website. And I suspect a drive-by-download, so I want to check my machine to see since that time in order of creation which files have been created or changed. And I know that I can use the find command to view files which have been changed, say, less than 3 days ago:

sudo find / -mtime -3

But I want it to be after that specific data and time that it shows me the file created and changed, I would also like it to show me it in the order in which these files have been created and/or changed, and one last thing which would be really useful is if it were to also (next to each result) show me the last modification date of that file. So is there any way of achieving this?


OS Information:

Description:    Ubuntu 15.04
Release:    15.04

Package Information:

findutils:
  Installed: 4.4.2-9build1
  Candidate: 4.4.2-9build1
  Version table:
 *** 4.4.2-9build1 0
        500 http://gb.archive.ubuntu.com/ubuntu/ vivid/main amd64 Packages
        100 /var/lib/dpkg/status

1 Answer 1

8

To show all files created on 16/05/2015:

sudo find / -type f -newermt 2015-05-16

Now to see attributes such as owner, modification date, permissions easily use ls -l command:

sudo find / -type f -newermt 2015-05-16 | xargs ls -l

Thanks to muru note: same result can be achieved with:

sudo find / -type f -newermt 2015-05-16 -ls

Read this for more information on what ls -l means.

UPDATE To sort easily use -t option with ls (from newest to oldest)

sudo find / -type f -newermt 2015-05-16 | xargs ls -lt

If you want a reverse sort (from oldest to newest)

sudo find / -type f -newermt 2015-05-16 | xargs ls -ltr

And you can pipe it to tee to output in Terminal and in a log file too.

7
  • 1
    find has an -ls option.
    – muru
    May 19, 2015 at 10:23
  • I am finding that it is outputting them in random order (or at least not in oldest-newest, or newest-oldest as I would like). How would you get it to output in one of these orders?
    – user364819
    May 19, 2015 at 10:39
  • @ParanoidPanda check the edit
    – Maythux
    May 19, 2015 at 11:35
  • It only shows back until May 18 19:32, so does this mean that it just had a limit to the time period it can show, or does it mean that all the stuff on my system was changed/created then, and after, and nothing before that still exists?
    – user364819
    May 19, 2015 at 16:51
  • This means last modified file on your system is on May 18 19:32
    – Maythux
    May 20, 2015 at 5:46

You must log in to answer this question.