# Comparison of current installation with original



## balanga (May 18, 2021)

How can I identify which files have been changed or added since the OS was originally installed? I'm talking about just the OS without any packages?

The original would have just been the extracted kernel.txz and base.txz so a diff of those files against current would be fairly close. Can anyone suggest how to do this? I suspect that there would be very few changes, but I'd like to make sure. I'm assuming a freebsd-update has not been done since the installation.


----------



## Alain De Vos (May 18, 2021)

```
cat /var/log/messages | grep pkg
```
And,

```
pkg info | awk '{print $1}' | xargs -I {} pkg info -lx {}
```
The default install has no "/usr/local" so anything in "/usr/local" comes from a package.
Kernel module packages write into "/boot/modules"


----------



## kpedersen (May 18, 2021)

In the past I have done something like:

`find / | sort > mtree.orig`

Then I can run a similar command (output to a different file) and then use `diff` to compare the two files for lines that have altered.

If you want to check for modified files, then you will possibly need to output their size (`wc -c` or a hash (i.e md5) as part of the listing.

I wonder if something like Git could be used. Base is fairly small, so you could maybe init a new repo in the root, add everything and then use `git status` from then on.


----------



## chrbr (May 18, 2021)

Dear balanga,
please have a look at mtree(8). Something as

```
mtree -c -K md5 -R time -p /etc > mtree_etc.spec
```
would write the md5 of the current /etc tree to a file.

```
mtree -K md5 -R time -p /etcr -f mtree_etc.spec
```
would compare the current situation with a previously recorded situation.
You can add or remove keywords or use a different checksum algorithm. mtree(8) is quite flexible.

Ok, I see that kpetersen has posted a few seconds ago. That works, too. It is a matter of taste, there might be more options to choose from .


----------



## kpedersen (May 18, 2021)

chrbr said:


> Ok, I see that kpetersen has posted a few seconds ago. That works, too. It is a matter of taste, there might be more options to choose from .


I think mtree is the correct tool to use. Mine was perhaps a "poor man's" solution if that command doen't exist 

I didn't know it was part of base.


----------



## balanga (May 18, 2021)

Never used mtree(), but it seems like the right tool, so I'm going to study 'a small guide on how to use it' Thread 61113 written by ShelLuser


----------



## covacat (May 18, 2021)

```
mkfifo /tmp/pix$$;tar xjOf kernel.txz >/tmp/pix$$ & tar tjvf kernel.txz |while read t n u g s d1 d2 d3 name;do [ $s -eq 0 ] && continue;echo -n "$name ";head -c $s <&3 |md5;done 3</tmp/pix$$;rm /tmp/pix$$
```

shows checksums in tar file without extracting to disk


----------

