If I run a command in bash, is there any way to determine which files and directories were modified as a result of running that command?

For example, if i run:

export $MYDIR="/home/users/myuser/"
touch $MY_DIR/*

I would like to be able to list the files that were modified:


But not specifically for touch. I would like the solution to be general for any command.

Is this possible?

2 Answers 2


There are a couple of tools which I quite like for this kind of use case:

  • maybe will run a command, but fake any modification to the file system (pretend it succeeded without performing it, and log it), then display a list of all the changes; you can then decide whether to run the command again — it’s not perfect, see the list of issues, but it’s good enough in many cases;
  • LoggedFS provides a logging file system overlay, which lets all changes to a file system go through but logs them, in a configurable manner (see LoggedFS configuration file syntax for details).

Other tools commonly used to trace file system operations include inotifywait and auditd; see Linux file access monitoring for details.


For a basic / simplistic solution, how about creating a file first, and then, after your operation, running a find to display files newer than said file ?

touch /tmp/myfile
( do stuff )
find ${MY_DIR} -newer /tmp/myfile

As @roaima points out, this only address your "which files and directories were modified as a result" requirement : it would not identify files that were removed.

  • 1
    You'd need a "before and after" to catch a tool that removed files Commented Aug 21, 2018 at 8:18
  • Note that it's zsh syntax. With bash (see tag in OP's question), you'd need find "$MY_DIR". find ${MY_DIR} would only make sense in bash if $MY_DIR was meant to contain a $IFS-separated list of file patterns that you intended to expand. (:-b) Commented Aug 27, 2018 at 18:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .