An installer which isn't really clean (Adobe Acrobat Reader DC) installed on my Unix (Mac OS X) a lot of files in different places.
I have a reference file
Application which I am pretty sure was installed at the beginning of this huge install process and I am sure this install process took less than 2 minutes.
ls -lc /Application
I am able to get the correct time of creation of this reference file :
-rwxrwxr-x 3 root wheel 102 Dec 24 18:39 /Application
With this information I built a simple
find command to estimate the size of the damage:
find / -newermt '12/24/2015 18:37' ! -newermt '12/24/2015 18:41' -ls
And I can check that this approach is listing all the files modified or created by this installer and nothing else.
(Here is the trick: make the same
find on the previous 5 minutes range,
and on the next 5 minutes range and check they are empty. To be honnest,
I'm lucky: my Unix was quiet at this time.)
How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the
Dec 24 18:39 → 12/24/2015 18:37, 12/24/2015 18:41