Suppose an employee came in to the office for a whole day over the weekend and shortly thereafter handed in their notice.
Is there a way on Linux (in our case Centos 7) to eliminate the possibility that data theft occurred? The kind of activity of interest would be zipping up fairly sizeable folders (over 1TB) containing many files - a time consuming process that might be noticed during a work day.
Let's suppose access to the Centos 7 server were from an iMac which connects using NetaTalk (an open source Linux implementation of Apple File Protocol).
Since the majority of files are not accessed frequently - in fact we would expect most to not have been accessed since well before some hypothetical weekend visit - my thoughts are that simple file access logs would be sufficient to betray such activity since it would show all affected files having been accessed on that date.
Is there a way therefore to list access times for large numbers of files on a Linux (Ext4 I think) volume, if no trace is set up in advance, and if so, how?