You need to consider what is sufficient heuristic to define "modified."
In order of increasing cost and accuracy:
file size (file contents can still be resized as long as the size is supported)
file timestamp (if you are not using ntpd, time is not monotonous)
sha1sum file (bulletproof but expensive)
I will run ntpd and then scroll through the timestamps and then compare the checksum if the timestamp changes. It can cover a lot of land in a short time.
These methods are not suitable for a computer security application; they are designed to manage files in a smart system.
source share