A few years back when I was still using Windows, I used a tool called "Cheat Engine" which allowed you to scan for memory addresses. For instance, if you wanted to find out which address stored the position of a window, you would:

  • do an initial scan
  • move the window
  • filter out all addresses that didn't change
  • don't move the window
  • filter out all addresses that changed
  • move the window
  • filter out all addresses that didn't change
  • ...

until you were left with a single address. And that would be the one containing the window position.

I would like to do something similar, but on Linux and with files instead of memory addresses.

I basically want to find a couple of config files that aren't documented properly. So what I'd like to do is:

  • do an initial scan of all files
  • change a setting that would modify my target config file
  • filter out all files that have not changed
  • do nothing
  • filter out all files that have changed
  • etc.

until I'm left with only one file. (The config file that I was looking for.)

Is there a tool for Linux to achieve that? Or do you know of a simple way to do it in bash maybe?

2 Answers 2


The find command will search a specified path (/target_directory in the example below) for files (-type f) which have changed in the last two minutes (-mmin -2) then use ls to show you those files and details about them:

touch changes.txt
find /target_directory -type f -mmin -2 -exec ls -al {} \; >> changes.txt
time >> changes.txt
sleep 60
find /target_directory -type f -mmin -1 -exec ls -al {} \; >> changes.txt
less changes.txt

I believe running that is a simpler way to help search for your config files.


You don't need the initial scan of the files. Just create a timestamp file. Then, after some time, look for files that have been modified after the creation of the timestamp file.

touch timestamp

# time passes

find top-dir -type f -newer timestamp

This obviously does not catch files that have been deleted.

  • 1
    That's a good idea. Although it would be less bullet proof. For instance if an application writes its config to a file every few seconds, no matter if it differs or not, I would expect the timestamp to change, but the content to stay the same.
    – Forivin
    Commented Jun 28, 2018 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .