Forensic analysis: find all files modified around a known one

Question

An installer which isn't really clean (Adobe Acrobat Reader DC) installed on my Unix (Mac OS X) a lot of files in different places.

I have a reference file Application which I am pretty sure was installed at the beginning of this huge install process and I am sure this install process took less than 2 minutes.

With:

ls -lc /Application

I am able to get the correct time of creation of this reference file :

-rwxrwxr-x  3 root  wheel  102 Dec 24 18:39 /Application

With this information I built a simple find command to estimate the size of the damage:

find / -newermt '12/24/2015 18:37' ! -newermt '12/24/2015 18:41' -ls

And I can check that this approach is listing all the files modified or created by this installer and nothing else.

(Here is the trick: make the same find on the previous 5 minutes range, and on the next 5 minutes range and check they are empty. To be honnest, I'm lucky: my Unix was quiet at this time.)

How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39    →    12/24/2015 18:37, 12/24/2015 18:41

Answer 1

Since I needed this kind of tool for misconceived installers and crapware, I wrote it:

crater

to evaluate the damage made by any misbehaving software.

#!/bin/sh
# shell script to search for files created or modified around
# a reference modified file (known impact on the file system) 
# default time interval to search is 5 minutes

_cn=`basename $0`

USAGE="Usage: ${_cn} impact_reference_file [delay_around_impact_in_minutes]"

case $# in
1|2)
        _ref_file="$1"
        ;;
*)
        echo "${USAGE}" >&2
        exit 2
        ;;
esac

_ref_date=`ls -ldT "${_ref_file}" | awk '{printf ("%s %2s %s %s\n", $6, $7, $8, $9)}'`

_minutes=${2:-5}
_seconds=`expr ${_minutes} \* 60`
_format="+%m/%d/%Y %H:%M:%S"

echo "\treference date:\t${_ref_date}"

# convert reference date in seconds since the epoch
# so as to make arithmetic on it

_ref_date_epoch=`date -j -f "%b %e %T %Y" "${_ref_date}" "+%s"`
_beg_date_epoch=`expr ${_ref_date_epoch} - ${_seconds}`
_end_date_epoch=`expr ${_ref_date_epoch} + ${_seconds} + 1`
_log="/var/log/${_cn}_`date -r ${_ref_date_epoch} +%d-%m-%Y_%H:%M:%S`.log"
echo "\tlog: \t\t${_log}"

# convert back to the format for find
_beg_date=`date -r ${_beg_date_epoch} "${_format}"`
_end_date=`date -r ${_end_date_epoch} "${_format}"`

echo "\tbeginning time:\t${_beg_date}"
echo "\tending time:\t${_end_date}"

find / -xdev -newerct "${_beg_date}" ! -newerct "${_end_date}" -ls >${_log}

awk '{n++; s+=$7}END{printf ("\timpact:\t\t%d files\t\t%d bytes\n", n, s) }' ${_log}

How to install it:

• paste the above source in crater.sh
• make crater

How to use it:

/usr/bin/sudo ./crater impact_reference_file delay_around_impact_in_minutes

Example:

/usr/bin/sudo ./crater /Applications/Adobe\ Reader.app
Password:
        reference date: Dec 29 16:11:56 2015
        log:            /var/log/crater_29-12-2015_16:11:56.log
        beginning time: 12/29/2015 16:06:56
        ending time:    12/29/2015 16:16:57
        impact:         1518 files              298217339 bytes

Compatibility:

Tested on FreeBSD, MacOS X & Linux.

Answer 2

How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39 → 12/24/2015 18:37, 12/24/2015 18:41

You can accomplish this using the date command's relative time feature:

$ date -d"Dec 24 18:39 2 minutes ago" +'%m/%d/%Y %R'
12/24/2015 18:37

and

$ date -d"Dec 24 18:39 2 minutes" +'%m/%d/%Y %R'
12/24/2015 18:41

Here's an example of how you might use it in your situation. This script would be called with the directory, the reference date, and the number of minutes to pad on each side of the reference date (time). Invoked in this way:

sh ./myscript / "Dec 24/2015 18:39" 2

the script effectively executes the command:

find "/" -newermt "12/24/2015 18:37" ! -newermt "12/24/2015 18:41" -ls

Script:

#!/bin/sh

# usage: $0 directory reference-date minutes

dir=${1:-/}
ref=${2:-Dec 24 18:39}
mins=${3:-2}
format='+%m/%d/%Y %R'

begin=$(date -d"$ref $mins minute ago" "$format")
end=$(date -d"$ref $mins minute" "$format")

echo "# ref='$ref'"
echo "# begin='$begin'"
echo "# end='$end'"

find "$dir" -newermt "$begin" ! -newermt "$end" -ls