Scan for Updated Files

It can happen. A person hired to do something on a server can turn out to be untrustworthy.

It happened to an acquaintance. Like you always should, my friend changed the server's passwords after the person was done with the project.

Soon thereafter, my friend got complaints from his hosting company that the server was sending spam emails.

The offending script was found and deleted. It had the same file date as the date the person had access to the server. It appears that the spamming script was installed while the person worked on the project they were hired for.

Files Monitor is very good at spotting files added to the server or changed. But it needs to be installed to obtain a snapshot of the files already on the server before it can compare subsequent changes. Therefore, while it can be so very valuable to spot changes on the server, it had not been installed before the disruption and could not help in this case.

A script was needed to detect file additions or modifications that occurred on or after a certain date.

The PHP script accompanying this article was designed to do exactly that. The Scan for Updated Files script does a search of the domain's file directories and reports files created or changed after a date specified within the script.

The Scan for Updated Files script can search only within document directories. That would be directories a browser or bot has access to, locations with URLs.

Within the script, in the customization area, you specify the date and time to look for. Scan for Updated Files then checks the modified date of each file it finds ("modified" being the most recent time when the file was created or updated). If the modified date is at the date and time you specified or later, it is a match and the file is reported as updated.

Also within the script, you specify the directory to be scanned. If you specify '/', then the scan will begin in the document root. Every subdirectory from that beginning directory will also be scanned.

The output from Scan for Updated Files is published in the browser window where the script is running. The output is a list of files with dates that match your specification. If you specify that it shall, the output will also contain a list of directories that are searched.

Here is the PHP source code of the Scan for Updated Files script. Customization notes follow.

<?php /*
Scan for Updated Files
Version 1.0
August 15, 2022
Will Bontrager Software LLC
https://www.willmaster.com/
*/

// Timezone for dates and times is UTC (Universal Time Coordinated, sometimes known as Greenwich Mean Time).

/* Customizations */

// Specify start date year, month, and day. If necessary, adjust hour, minute, and second (0's indicate midnight).
$startYear = 2022;
$startMonth = 8;
$startDay = 15;
$startHour = 0;
$startMinute = 0;
$startSecond = 0;

// Specify the directory to start the scan (all subdirectories will be scanned). Use / to indicate document root directory.
$baseDirectory = '/';

// In addition to listing files with matched dates, shall every directory searched also be individually listed? (yes/no)
$listSearchedDirectories = 'no';

/* End of customizations */

date_default_timezone_set('UTC');
$baseDirectory = preg_replace('!/$!','',$baseDirectory);
if( strlen($baseDirectory) and strpos($baseDirectory,'/')!==0 ) { $baseDirectory = "/$baseDirectory"; }
$dir = preg_replace('/^'.preg_quote($_SERVER['DOCUMENT_ROOT'],'/').'/','',$baseDirectory);
$dir = "{$_SERVER['DOCUMENT_ROOT']}$baseDirectory";
$timestamp = mktime($startHour,$startMinute,$startSecond,intval($startMonth),intval($startDay),intval($startYear));
$listSearchedDirectories = strtolower(trim($listSearchedDirectories));
$writedir = ( strpos($listSearchedDirectories,'y')===0 or intval($listSearchedDirectories)==1 ) ? true : false;
echo '<pre>';
if($writedir) { echo "Matched files are marked with word UPDATED.\n"; }
Scan4UpdatedFiles($dir);
echo '</pre>DONE';
function Scan4UpdatedFiles($dir)
{
   global $timestamp, $writedir;
   if( $writedir ) { echo "\nEntering directory $dir\n"; }
   $recursive = array();
   foreach( scandir($dir) as $f )
   {
      if( preg_match('/^\.\.?$/',$f) ) { continue; }
      $fLocation = $dir . '/' . $f;
      if( is_dir($fLocation) )
      {
         foreach( Scan4UpdatedFiles($fLocation) as $F) { $recursive[] = $f . '/' . $F; }
      }
      else
      {
         $tm = filemtime($fLocation);
         $freport = $writedir ? $f : $fLocation;
         if( $tm >= $timestamp ) { echo 'UPDATED ' . date('F d, Y H:i:s',$tm) . " > $freport\n"; }
         $recursive[] = $f;
      }
   }
   return $recursive;
}
?>

Customization notes —

There are three things to customize, the start date and time, the directory where to begin the scan, and whether to list individual directories that were searched.

1. The start date and time —

   Specify the earliest date and time to match file modified times.

   These are assumed to be in time zone UTC (Universal Time Coordinated, sometimes known as Greenwich Mean Time). The time in your specifications may need to be adjusted to account for your server's time zone. If it isn't very critical, you may just specify the day earlier rather than calculate time zone differences.

   This is what you find in the above source code.

   $startYear = 2022; $startMonth = 8; $startDay = 15; $startHour = 0; $startMinute = 0; $startSecond = 0;

   Update $startYear, $startMonth, and $startDay with appropriate year, month, and day numbers.

   The $startHour = 0 that you see in the PHP script source code, above, specifies the instant the new day starts, at midnight. The $startMinute = 0 specifies the instant a new hour starts and $startSecond = 0 specifies the instant a new minute starts. When all three are specified as 0, it means the instant a new day is born.

   If you need to change $startHour, specify a number 0 through 23. If you need to change $startMinute or $startSecond, specify a number 0 through 59.

2. The directory where to begin the scan —

   To start the scan at the document root directory, the $baseDirectory = '/'; in the above source code has it correct. Otherwise, specify $baseDirectory = '/other-directory'; (replacing other-directory with the correct directory name).

3. Whether to list individual directories that were searched —

   When the Scan for Updated Files software matches the modification date of a file with your specification, it publishes the modification date and file name in the browser window.

   If you also want the PHP script to publish each directory it scans, change $listSearchedDirectories = 'no'; to $listSearchedDirectories = 'yes'; (the two valid values are 'yes' and 'no').

That is all for the customizations.

Save the source code as Scan4UpdatedFiles.php (or other *.php file name), upload it, and make a note of its URL.

To use Scan4UpdatedFiles.php, type its URL into your browser's address bar. It will look for, and report, files added or changed on or after the date you specified.

Note for large sites —

Scan for Updated Files was built for smaller websites.

If your website has many files, 10,000 or more, then Scan for Updated Files may time out or run out of memory — when the scan begins in the document root or a huge subdirectory. How many files can be scanned at one go and how much memory is available depends on your server and its resources.

If Scan for Updated Files does time out or run out of memory, one of these steps may work.

• Scan one subdirectory at a time until all have been scanned.

• Update the .htaccess file where Scan for Updated Files will run. Either or both of these may be done (assuming your hosting company has them enabled):

  1. php_value max_execution_time [#]
     

     Replace [#] with a number of seconds, 360 for example.

  2. php_value memory_limit [#]
     

     Replace [#] with a size, 512M for example.

  PHP Form Submission Limits talks more about changing those and other limits with the .htaccess file.

• Customize the Scan for Updated Files script for your particular server, which is likely to need skilled programming.

One of the above should work for time out or run out of memory situations on servers with a huge number of files.

The Scan for Updated Files software is fast. And it is a handy tool for when you need to know which files were modified at a certain date or later.

(This article first appeared in Possibilities newsletter.)

Will Bontrager