I often do this to find out what files were installed where. $ touch now $ install.sh $ find / -newer now That is supposing you trust install.sh o

I often do this to find out what files were installed where. $ touch now $ install.sh $ find / -newer now That is supposing you trust install.sh of course. You can redirect the output of find to a file for later removal. You will have to filter out false positives from the 'find' output, usually dev nodes.