File Integrity · How-To

    How to Detect What Changed in a Folder

    Filenames lie and dates drift. Here's the reliable way to know exactly what changed in a folder — every added, edited, and deleted file — and how to get told automatically the moment it happens.

    Published June 30, 20268 min read
    Mehrab Ali

    Author

    Mehrab Ali

    Data Scientist, Researcher & Entrepreneur

    Founder of ARCED Foundation, ARCED International, and Solutions of Things Lab (SoTLab). Built FolderManifest to help teams protect file integrity and stay audit-ready.

    Quick answer

    To detect what changed in a folder, capture a baseline when it's in a known-good state, then compare the folder against that baseline later. The reliable method is a checksum manifest: it records a SHA-256 hash of every file once, and a verify step reports exactly which files were added, removed, or modified since. Filenames and "date modified" can't be trusted — contents change without either changing.

    • Baseline now, verify later — that's the whole idea.
    • Checksums catch edits that timestamps miss.
    • Detects added and deleted files, not just changed ones.
    • Schedule it and get told only when something drifts.

    Why dates and filenames fail

    The instinct is to sort by "date modified" and scan for anything recent. It feels right and it's quietly unreliable:

    • ·Timestamps can be preserved. Plenty of tools rewrite a file's contents while keeping its original modified date — the change is real, the date says nothing happened.
    • ·Timestamps can be reset. Copies, syncs, and restores routinely stamp everything with the same "now," burying real changes in noise.
    • ·Filenames don't reflect contents. The same name can hold completely different bytes — a replaced logo, an edited spreadsheet, a swapped config.
    • ·You can't eyeball additions. One new file dropped into a folder of thousands is invisible to a manual scan.

    The only thing that reliably reflects "did this file change?" is the file's actual content — and that's what a checksum measures.

    The baseline idea

    A checksum is a short fingerprint computed from a file's contents — change one byte and the fingerprint changes completely (see verifying folder integrity with checksums). A manifest is just a list of those fingerprints for every file in a folder, captured at one moment you trust.

    That manifest is your baseline. Detecting changes then becomes a simple question: does the folder still match its baseline? This is different from comparing two folders — you're not comparing folder A to folder B, you're comparing this folder to its own earlier self.

    Three kinds of change a baseline catches

    ChangeHow it's detectedMissed by date/name?
    ModifiedHash differs from the baselineOften — if the timestamp is preserved
    DeletedIn the baseline, missing nowEasily — nothing draws your eye to it
    AddedPresent now, not in the baselineEasily — one file hides in thousands

    That third row is the one most tools miss. A plain sha256sum -c only re-checks the files in its list, so a newly added file slips by. Catching additions needs a full-folder comparison.

    How to do it

    With the FolderManifest CLI it's two commands. First, capture the baseline while the folder is good:

    Terminal
    foldermanifest generate "C:\Project" --format json --out project-baseline

    Later — a day, a week, after a handoff — verify the folder against that baseline. The report lists every added, removed, and modified file, and the command exits 0 if nothing changed, 1 if anything did:

    Terminal
    foldermanifest verify "C:\Project" --manifest project-baseline.json
    
    Verify: 3 changes since baseline.
      modified  reports/q3.xlsx
      added     notes/new-draft.docx
      removed   config/old.yml

    That's the reliable answer to "what changed in this folder?" — contents-based, complete, and repeatable. It works the same on Linux; on Windows you can also reach for PowerShell Get-FileHash for one-off file checks.

    Monitor a folder automatically

    Detecting changes once is useful; getting told about them is better. Because verify returns a clean exit code, you can schedule it and alert only on drift — silence on a clean night, a message the moment something moves:

    Terminal (cron / Task Scheduler)
    foldermanifest verify "C:\Project" --manifest project-baseline.json --quiet
    # exit 0 -> do nothing; exit 1 -> send an alert

    The full scheduled setup — Windows Task Scheduler, exit-code alerting, and watching many folders at once — is in automate folder verification with the CLI.

    Prefer a click, not a command?

    The same workflow lives in the FolderManifest desktop app: open a folder, generate a manifest, and run a verify whenever you want a readable report of what's changed — added, edited, and deleted files, with a clear summary you can save or share. The command line is there when you want to automate it; the app is there when you just want to look.

    Know exactly what changed — every time

    FolderManifest takes a SHA-256 baseline of your folder and tells you precisely what's been added, edited, or deleted since. Desktop app and CLI on Windows and Linux — free for 7 days.

    Frequently asked questions

    How do I detect what changed in a folder?
    Take a baseline of the folder when it is in a known-good state, then compare the current folder against that baseline later. The reliable way is a checksum manifest: it records a SHA-256 hash of every file once, and a verify step reports exactly which files were added, removed, or modified since. Filenames and dates alone are not enough, because contents can change without either changing.
    Why can't I just look at the "date modified" column?
    Modified dates are easy to miss and easy to fake. Some programs preserve timestamps when they rewrite a file, sync tools can reset them, and a silent corruption may not touch the date at all. A checksum reads the actual bytes, so it detects a changed file even when the timestamp says nothing happened.
    What is the difference between comparing two folders and detecting changes in one folder?
    Comparing two folders answers "how do A and B differ right now?" Detecting changes in one folder answers "how is this folder different from how it was before?" The second needs a saved baseline of the folder's earlier state — a manifest — rather than a second live folder to compare against.
    How can I detect files that were added or deleted, not just edited?
    A manifest records the full list of files, so verification flags three kinds of drift: modified files (the hash changed), deleted files (in the baseline, missing now), and added files (present now, not in the baseline). Tools that only re-check a list of known hashes, like sha256sum -c, miss added files.
    Can I monitor a folder for changes automatically?
    Yes. Once you have a baseline, schedule the verify step with Windows Task Scheduler or Linux cron. The command exits 0 when nothing changed and 1 when something did, so your script can stay silent on a clean run and alert you only when the folder actually drifts.
    Does checking a folder for changes modify the folder?
    No. Verification is read-only: it hashes the current files and compares them to the baseline. It never writes, moves, or deletes anything in the folder being checked, so it is safe to run repeatedly and on a schedule.
    What is the fastest way to see what changed without scripting?
    Open the folder in the FolderManifest desktop app, generate a manifest, and later run a verify — the report lists every added, removed, and modified file with a clear summary. The same workflow is available from the command line when you want to automate it.

    Related: Automate folder verification · Compare two folders · Verify folder integrity with checksums