clamav-users October 2011 archive
Main Archive Page > Month Archives  > clamav-users archives
clamav-users: Re: [clamav-users] Scan files by date

Re: [clamav-users] Scan files by date

From: Matus UHLAR - fantomas <uhlar_at_nospam>
Date: Mon Oct 10 2011 - 09:28:11 GMT

>> On 9/30/2011 9:37 PM, Rohler, Brian L wrote:
>>> I have a large number of files (9TB) with over a million files and
>>> thousands of directories. I would like to scan the group one time so
>>> I have a good baseline. After that I would like to scan files that
>>> are less than 365 days old. Can I use clamscan to scan files by
>>> date?

>On 9/30/2011 10:56 PM, Nathan Gibbs wrote:
>> clamscan itself isn't that smart, but if you are using unix, find could
>> feed a list of things to clamscan.

On 03.10.11 11:34, Bowie Bailey wrote:
>Just keep in mind that it is quite easy to arbitrarily change a file's
>timestamp in linux, so it would be possible for a malicious program to
>modify a file and then update the timestamp so that it looks like the
>file has not been modified.

luckily un*x filesystems have ctime (inode change time) which changes
everytime someone does this, so find can use -ctime option to get even
such files

-- Matus UHLAR - fantomas, ; Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Enter any 12-digit prime number to continue. _______________________________________________ Help us build a comprehensive ClamAV guide: visit