Lets say i have an existing directory and someone did cp -r over this and some files changed. I want to detect this change. How can i do it ?
I thought of using md5 or some checksum calculator for directory but it could make my program slow since directory size can be way huge.
/var/lib/dpkg/info/*.md5sums(that can be edited by privileged users). For private data you may as well usegit. Tampering detection is a whole other can of worms.