An installer which isn't really clean (Adobe Acrobat Reader DC) installed on my Unix (Mac OS X) a lot of files in different places.

I have a reference file Application which I am pretty sure was installed at the beginning of this huge install process and I am sure this install process took less than 2 minutes.


ls -lc /Application

I am able to get the correct time of creation of this reference file :

-rwxrwxr-x  3 root  wheel  102 Dec 24 18:39 /Application

With this information I built a simple find command to estimate the size of the damage:

find / -newermt '12/24/2015 18:37' ! -newermt '12/24/2015 18:41' -ls

And I can check that this approach is listing all the files modified or created by this installer and nothing else.

(Here is the trick: make the same find on the previous 5 minutes range, and on the next 5 minutes range and check they are empty. To be honnest, I'm lucky: my Unix was quiet at this time.)

How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39    →    12/24/2015 18:37, 12/24/2015 18:41
  • What are you trying to install and how did you install it ?
    – Panther
    Dec 30, 2015 at 12:43
  • 3
    You may want to check ctime rather than mtime, in case the installer extracted files from an archive in a way that preserved their mtime. Dec 30, 2015 at 15:41
  • I will have to use ctime because it did :(.
    – dan
    Dec 30, 2015 at 23:51

2 Answers 2


Since I needed this kind of tool for misconceived installers and crapware, I wrote it:


to evaluate the damage made by any misbehaving software.

# shell script to search for files created or modified around
# a reference modified file (known impact on the file system) 
# default time interval to search is 5 minutes

_cn=`basename $0`

USAGE="Usage: ${_cn} impact_reference_file [delay_around_impact_in_minutes]"

case $# in
        echo "${USAGE}" >&2
        exit 2

_ref_date=`ls -ldT "${_ref_file}" | awk '{printf ("%s %2s %s %s\n", $6, $7, $8, $9)}'`

_seconds=`expr ${_minutes} \* 60`
_format="+%m/%d/%Y %H:%M:%S"

echo "\treference date:\t${_ref_date}"

# convert reference date in seconds since the epoch
# so as to make arithmetic on it

_ref_date_epoch=`date -j -f "%b %e %T %Y" "${_ref_date}" "+%s"`
_beg_date_epoch=`expr ${_ref_date_epoch} - ${_seconds}`
_end_date_epoch=`expr ${_ref_date_epoch} + ${_seconds} + 1`
_log="/var/log/${_cn}_`date -r ${_ref_date_epoch} +%d-%m-%Y_%H:%M:%S`.log"
echo "\tlog: \t\t${_log}"

# convert back to the format for find
_beg_date=`date -r ${_beg_date_epoch} "${_format}"`
_end_date=`date -r ${_end_date_epoch} "${_format}"`

echo "\tbeginning time:\t${_beg_date}"
echo "\tending time:\t${_end_date}"

find / -xdev -newerct "${_beg_date}" ! -newerct "${_end_date}" -ls >${_log}

awk '{n++; s+=$7}END{printf ("\timpact:\t\t%d files\t\t%d bytes\n", n, s) }' ${_log}

How to install it:

  • paste the above source in crater.sh
  • make crater

How to use it:

/usr/bin/sudo ./crater impact_reference_file delay_around_impact_in_minutes


/usr/bin/sudo ./crater /Applications/Adobe\ Reader.app
        reference date: Dec 29 16:11:56 2015
        log:            /var/log/crater_29-12-2015_16:11:56.log
        beginning time: 12/29/2015 16:06:56
        ending time:    12/29/2015 16:16:57
        impact:         1518 files              298217339 bytes


Tested on FreeBSD, MacOS X & Linux.


How may I make a general and simple forensic script of this method so as to compute the 2 dates useful for the find:

Dec 24 18:39 → 12/24/2015 18:37, 12/24/2015 18:41

You can accomplish this using the date command's relative time feature:

$ date -d"Dec 24 18:39 2 minutes ago" +'%m/%d/%Y %R'
12/24/2015 18:37


$ date -d"Dec 24 18:39 2 minutes" +'%m/%d/%Y %R'
12/24/2015 18:41

Here's an example of how you might use it in your situation. This script would be called with the directory, the reference date, and the number of minutes to pad on each side of the reference date (time). Invoked in this way:

sh ./myscript / "Dec 24/2015 18:39" 2

the script effectively executes the command:

find "/" -newermt "12/24/2015 18:37" ! -newermt "12/24/2015 18:41" -ls



# usage: $0 directory reference-date minutes

ref=${2:-Dec 24 18:39}
format='+%m/%d/%Y %R'

begin=$(date -d"$ref $mins minute ago" "$format")
end=$(date -d"$ref $mins minute" "$format")

echo "# ref='$ref'"
echo "# begin='$begin'"
echo "# end='$end'"

find "$dir" -newermt "$begin" ! -newermt "$end" -ls
  • My date has a -d dst option for setting the daylight saving time. My Unix is a MacOS X, and I think I will be able to achieve the same computation with -j -f input_fmt new_date.
    – dan
    Dec 31, 2015 at 8:57
  • Sorry, I now realize you said Unix. I'm looking into it.
    – RobertL
    Dec 31, 2015 at 22:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .