Changed File Analysis (See related posts)

//Search through a directory looking for modified files - uses one-way hash function. Run once to initalize files, then run at a later date for analysis.

#
#   A ruby script to detect changed/added/deleted files
#     using one-way hash function - MD5 used, but could be changed
#
#    Written by:  Steve at pentest.it
#                 www.pentest.it
#
# Usage: changed.rb 
#      Output files will be dumped into 
#
# MUST BE ABLE TO READ AND WRITE FILES
# Must have Digest::base installed

require 'digest/md5'

#initialize all hashes, regexp, and path array
oldfile_hash = Hash.new()
newfile_hash = Hash.new()
valid = /(.*)\s{5}(\w{32})/
#This array will store each directory to traverse
dir_array = Array.new()
dir_array[0] = ARGV.shift or raise "Missing path to traverse"

#Ensure the path is correct for file output
file_report = "#{dir_array[0]}\\file_report.txt"
file_output = "#{dir_array[0]}\\changed.files"
oldfile_output = "#{dir_array[0]}\\old_changed.files"

#Determine if the script has been run on the path before, if so change the file name
  if File.exists?(file_output)
    File.rename( file_output, oldfile_output)       #archive the file to make room for a new one
    File.open(oldfile_output, 'r+b') do |infile|   #open old_file to compare to new_file
      #read in the old files and md5 sums for each line in the file
      while (old_line = valid.match(infile.gets))
       oldfile_hash[old_line[1]] = old_line[2]
      end
    end
end

    #initialize the files to be used to write to
    report = File.new(file_report, 'wb')
    changed_files = File.new(file_output, 'wb')

  #Go through the directory and compute MD5 Hash until there aren't anymore items in directory array
  begin
    p = dir_array.shift   #remove one item from directory array 
    Dir.chdir(p)            #change to new directory to search
    #for each file in the dir, compute md5 sum and add to new hash
    Dir.foreach(p) do |filename|
      next if filename == '.' or filename == '..'   #go to next folder if '.' or '..'
      unless File::directory?(filename)                    #if not a folder, then process file
        file = File.open(filename, 'rb')
        newfile_hash[filename] = Digest::MD5.new(File.open(filename, 'rb').read).hexdigest
        file.close unless file.closed?
      else
        dir_array << p + "\\" + filename      #if nat a file, put the directories into array for later
      end
    end
  end while !dir_array.empty?
#write files found to changed.files
newfile_hash.each do |file, md5|
  changed_files.write "#{file}     #{md5}\n"
end
#remove files that are the same from hash tables
newfile_hash.keys.select {|file| newfile_hash[file] == oldfile_hash[file] }.each do |file|
  newfile_hash.delete(file)
  oldfile_hash.delete(file)
end
#write files that have been changed or added, then remove from has table
newfile_hash.each do |file, md5|
  report.write "#{oldfile_hash[file] ? "Changed" : "Added"} file: #{file} #{md5}\n"
  oldfile_hash.delete(file)
end
#write files that are left over the the oldfile_hash table - these are files that weren't found in the 
oldfile_hash.each do |file, md5|
  report.write "Deleted/Moved file: #{file} #{md5}\n"
end