Note: All the tools referred in this answer are already/easily available on Android.
You didn't mention which filesystem you want to monitor and whether you have access to that filesystem without root or not.
It's really hard to monitor an active filesystem like /data
which has hundreds of files being accessed and modified every moment. On the other hand a read-only filesystem like /system
never gets changed and you can easily identify any modifications.
OPTION 1:
A simple approach would be to take last modification date/time of all files on the filesystem and save the result as a text file. I assume you are interested in tracking changes made to a subdirectory of /data
partition:
~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >before.txt
After making changes to filesystem:
~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >after.txt
Now take a comparison of both:
~$ diff before.txt after.txt
You will identify all modified, removed and added files / directories / symlinks.
OPTION 2:
If the target is to identify more aggressively the possible hidden changes to a file e.g. made by some malware which retained modification time, create a MD5
checksum (works only for files):
~# find /data/xyz -type f -print0 | xargs -0 -I {} md5sum '{}' >checksums
After making changes:
~# md5sum -c --quiet checksums
It will identify any file changed even if the metadata of file is intact.
OPTION 3:
If you want to see the files being changed in realtime when you make changes, you can make use of Linux kernel's inotify
subsystem. A simple way is to use busybox inotifyd
:
~# inotifyd - /data/xyz
It will print out any kind of events happening to the watched file/directory.
Or use inotifywait
for more options. See this answer for details.
In order to find out what changes have been made to a file such as some configuration file, take a backup of that file/directory (or whole filesystem) prior to making changes.
RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?