Pedja Grujić's sandbox: Claymore

Need to know if your server-based files have changed? If new files have been added, or files have been deleted? Whether as part of your routine checks, or as remedial action after your server has been compromised, Claymore can be used to check for changes in your file system and provide a simple list of those files which have been added, deleted or modified since the last time you ran Claymore.

This module will scan files within a directory (including sub-directories), calculate their MD5 Hashes and then compare them against a log of the results from the previous execution to determine any files which have been added, deleted or modified during that period.

Within the Claymore Settings, exclusions can be set for any files/folders which should not be checked.

For best results, this file should be triggered by a cron job at regular intervals.
Also, be sure to add your email address to the Configuration Settings to ensure that you receive the notifications.

Module is based off great code written by Luke Stevenson (https://github.com/lucanos/Tripwire). We have been using his script to monitor our sites for file changes as a proactive way to make sure no malicious files have been uploaded.