I am looking for a way to find changes made to filesystem on Ubuntu. Like so:

  1. make some kind of a snapshot i.e. scan given folder (files, subfolders), save files names and sizes.
  2. install whatever, mess with files
  3. make second snapshot
  4. compare snapshots -> show a list of changed files.

Is there any tool which can accomplish this? I thought about version control, but I'd rather stick to something simple and more straightforward.

  • Do you need the ability to make a live snapshot ie without shutting down to do so? – thomasrutter Nov 27 '15 at 0:39
  • @thomasrutter it would be nice, but not necessary. The files that I want to check won't be accessed/changed by any threads all the time. – alex Nov 27 '15 at 0:44

You can use Back In Time to create snapshots. All snapshots (and also the live filesystem) can be compared by selecting the file/folder you are interested in and using View > Snapshots. Select the second snapshot to compare and press Diff. This will open a Side by Side view (using Meld) of both snapshots/live fs.

I'm member of BIT Dev-Team

  • Oooh this is exactly what I need. Just perfect! – alex Nov 27 '15 at 3:10

There are a few different approaches to this.

  • Use a sync or backup tool (such as one that uses rsync, such as backintime) to make backups of your system, and restore from those - rsync can quickly sync only the files with differences.

    Some such tools may even be designed for uses such as yours, ie they assist in the process of keeping backups of files from specific times.

    With this approach however you can't be guaranteed an atomic snapshot of the whole volume at once, ie if you run it on a live system you can't guarantee that all files backed up will come from the same time instance.

  • Use an alternative filesystem that supports live snapshots, like btrfs. There are filesystem-specific commands to create a snapshot with btrfs and you can read from that. Snapshots are atomic and you can even manage multiple snapshots.

    btrfs is not the only Linux filesystem that has this functionality, but it's probably the most general example.

    This functionality is equivalent to Windows Volume Shadow Copy, which they integrated into NTFS.

  • Use an alternative storage medium or block layer that supports live snapshots. LVM can do this. You could use RAID 1 mirroring for this but it would be slow each time you remove a drive from the array and then replace it.

    The drawback to an approach like this is you'd probably need an extra drive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.