apt install auditd auditctl -a always,exit -F dir=/home/backup -F perm=war md5sum /home/backup/* # any reading/writing command will do tail /var/log/audit/audit.log Reco