3

An installer which isn't really clean (Adobe Acrobat Reader DC) installed on my Unix (Mac OS X) a lot of files in different places.

I have a reference file Application which I am pretty sure was installed at the beginning of this huge install process and I am sure this install process took less than 2 minutes.

With:

ls -lc /Application

I am able to get the correct time of creation of this reference file :

-rwxrwxr-x  3 root  wheel  102 Dec 24 18:39 /Application

With this information I built a simple find command to estimate the size of the damage:

find / -newermt '12/24/2015 18:37' ! -newermt '12/24/2015 18:41' -ls

And I can check that this approach is listing all the files modified or created by this installer and nothing else.

(Here is the trick: make the same find on the previous 5 minutes range, and on the next 5 minutes range and check they are empty. To be honnest, I'm lucky: my Unix was quiet at this time.)

How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39    →    12/24/2015 18:37, 12/24/2015 18:41
  • What are you trying to install and how did you install it ? – Panther Dec 30 '15 at 12:43
  • 3
    You may want to check ctime rather than mtime, in case the installer extracted files from an archive in a way that preserved their mtime. – Mark Plotnick Dec 30 '15 at 15:41
  • I will have to use ctime because it did :(. – dan Dec 30 '15 at 23:51
3

Since I needed this kind of tool for misconceived installers and crapware, I wrote it:

crater

to evaluate the damage made by any misbehaving software.

#!/bin/sh
# shell script to search for files created or modified around
# a reference modified file (known impact on the file system) 
# default time interval to search is 5 minutes

_cn=`basename $0`

USAGE="Usage: ${_cn} impact_reference_file [delay_around_impact_in_minutes]"

case $# in
1|2)
        _ref_file="$1"
        ;;
*)
        echo "${USAGE}" >&2
        exit 2
        ;;
esac

_ref_date=`ls -ldT "${_ref_file}" | awk '{printf ("%s %2s %s %s\n", $6, $7, $8, $9)}'`

_minutes=${2:-5}
_seconds=`expr ${_minutes} \* 60`
_format="+%m/%d/%Y %H:%M:%S"

echo "\treference date:\t${_ref_date}"

# convert reference date in seconds since the epoch
# so as to make arithmetic on it

_ref_date_epoch=`date -j -f "%b %e %T %Y" "${_ref_date}" "+%s"`
_beg_date_epoch=`expr ${_ref_date_epoch} - ${_seconds}`
_end_date_epoch=`expr ${_ref_date_epoch} + ${_seconds} + 1`
_log="/var/log/${_cn}_`date -r ${_ref_date_epoch} +%d-%m-%Y_%H:%M:%S`.log"
echo "\tlog: \t\t${_log}"

# convert back to the format for find
_beg_date=`date -r ${_beg_date_epoch} "${_format}"`
_end_date=`date -r ${_end_date_epoch} "${_format}"`

echo "\tbeginning time:\t${_beg_date}"
echo "\tending time:\t${_end_date}"

find / -xdev -newerct "${_beg_date}" ! -newerct "${_end_date}" -ls >${_log}

awk '{n++; s+=$7}END{printf ("\timpact:\t\t%d files\t\t%d bytes\n", n, s) }' ${_log}

How to install it:

  • paste the above source in crater.sh
  • make crater

How to use it:

/usr/bin/sudo ./crater impact_reference_file delay_around_impact_in_minutes

Example:

/usr/bin/sudo ./crater /Applications/Adobe\ Reader.app
Password:
        reference date: Dec 29 16:11:56 2015
        log:            /var/log/crater_29-12-2015_16:11:56.log
        beginning time: 12/29/2015 16:06:56
        ending time:    12/29/2015 16:16:57
        impact:         1518 files              298217339 bytes

Compatibility:

Tested on FreeBSD, MacOS X & Linux.

1

How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39 → 12/24/2015 18:37, 12/24/2015 18:41

You can accomplish this using the date command's relative time feature:

$ date -d"Dec 24 18:39 2 minutes ago" +'%m/%d/%Y %R'
12/24/2015 18:37

and

$ date -d"Dec 24 18:39 2 minutes" +'%m/%d/%Y %R'
12/24/2015 18:41

Here's an example of how you might use it in your situation. This script would be called with the directory, the reference date, and the number of minutes to pad on each side of the reference date (time). Invoked in this way:

sh ./myscript / "Dec 24/2015 18:39" 2

the script effectively executes the command:

find "/" -newermt "12/24/2015 18:37" ! -newermt "12/24/2015 18:41" -ls

Script:

#!/bin/sh

# usage: $0 directory reference-date minutes

dir=${1:-/}
ref=${2:-Dec 24 18:39}
mins=${3:-2}
format='+%m/%d/%Y %R'

begin=$(date -d"$ref $mins minute ago" "$format")
end=$(date -d"$ref $mins minute" "$format")

echo "# ref='$ref'"
echo "# begin='$begin'"
echo "# end='$end'"

find "$dir" -newermt "$begin" ! -newermt "$end" -ls
  • My date has a -d dst option for setting the daylight saving time. My Unix is a MacOS X, and I think I will be able to achieve the same computation with -j -f input_fmt new_date. – dan Dec 31 '15 at 8:57
  • Sorry, I now realize you said Unix. I'm looking into it. – RobertL Dec 31 '15 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.