0

I know that you can use lsof (in Linux at least) to check which process has got a particular file opened currently, but is there anyway to find out which process created a particular file originally? Or even which process wrote/modified a particular file most recently?

Improve this question
1
  • I don't think there's a generic way to do this unless you're using iwatch or something, and, even then, it would be a timestamp thing. Is there a specific file you're worried about?
    – user47584
    Oct 28, 2014 at 17:04

1 Answer 1

Reset to default
1

Auditd would help with this. See http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/ for an introduction.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .