security - How can I audit a Linux filesystem for files which have been changed or added within a specific timeframe?

We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?

Answer

Start Over:
Personally, I would have trouble sleeping at night unless I just rebuilt each sever from a fresh install.

I recommend strongly you do this, hackers can hide things, and make them look like they have changed even if they have if they are good enough.

Why find won't work:
For example, to change the modification time:

kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22 foo
[kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo  
[kbrandt@kbrandt: ~/scrap/touch] ls -l foo

-rw-rw-r-- 1 kbrandt kbrandt 4 1998-12-13 05:30 foo

ctime might be better to search for if you go the find route, but there may be an easy way to change that as well. If not easy, someone could go in and just edit the filesystem itself with the device I imagine.

Just found the following online with ctime, haven't tried it though:

Since ctime is the last time the inode info was changed, you could
change the system date, make a new hardlink, remove it again and change
the date back.

And this stuff is only using tools that are already on the system in userland, forget what someone could do if they are proficient in kernel programming.