Find recently modified PHP files
find php files modified in last 7 days | website hacked which files changed | find recently changed files linux | find | malware | forensicsfind /var/www/vhosts/example.com/httpdocs -type f -name '*.php' -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort -rLists all PHP files whose content changed in the last few days, with date and time, newest first. After a break-in, this quickly shows which files were touched. Legitimate changes from updates usually stand out as a block with the same timestamp.
Note: Attackers like to reset the modification time. Using -ctime instead of -mtime checks the status change time, which cannot be faked as easily.
Also searched as
- find php files modified in last 7 days
- website hacked which files changed
- find recently changed files linux