title: How can I find files where ctime and mtime differ?
body: <p>Sometimes, a site is hacked and the intruder hides the new or modified files, changing the file's date (mtime). Usually, they set it to a not recent date.</p>
  
  <p>Using something like</p>
  
  <pre><code>find . -type f -ctime -3 -exec ls -ls {} \;
  </code></pre>
  
  <p>I can find files that have been changed or added in the last 3 days, also if the mtime was changed using <code>touch</code> or other tricks.</p>
  
  <p>The problem is that often this produces a long list of files that have been changed by normal activities.</p>
  
  <p>My idea is: If I can find files that have "strange" ctime - mtime, the monitoring is simpler. In my idea, if I can find files that have mtime > ctime or that have very different mtime and ctime, this simplifies greatly.</p>
  
  <p>Is there some way to do this with <code>find</code>?</p>