Incident Response - Finding New or Modified Files in Linux
When you are performing an incident response on a live system, one of your allies in the search for threat actors and all things not explainable is the find command in Linux. In this instance, we are using the find command in a small directory (however, it can be used at the / of the system) as per time. In this instance we are using ctime and mtime arguments
ctime: when the file was last changed (time)
mtime: when the file was last modified (time)
Linux Commands:
find . -type f -ctime -1 (Find files in current directory [.] of type file with a change time within 1 day)
find . -type f -mtime -1 (Find files in current directory [.] of type file with a modified time within 1 day)
Other points to consider is when you are running any of the above commands, you can also do the following to suppress some errors / warnings:
find . -type f -mtime -1 2 &≥1 or another way you can do this is: find . -type -mtime -1 2≥/dev/null notice that the greater than symbol had to be replaced as youtube does not allow it!
#incidentresponse #dfir #digitalforensics #socanalyst #cybersecurity