I’m still working on the amount changed, making sure I’m happy with it before it’s completely automated, but I’m working on parsing the results of summary and --dry-run on a precheck, so if oh, 10% of the files would be changed or more than cancel it, send me a notification, and for that I’d run it manually myself. Still fine tuning and not quite happy with it yet.

My first iteration was to cherry pick a few “key” files that would be randomly around my file system. Things that I will probably never ever change. This has been proven to work for a long time and honestly has saved my ass because I did accidently wipe out a few files once and this verified that my backups wouldn’t run until I fixed it. It’s a bit dumb but it did the trick for me:

#!/bin/bash

# check_file takes in a path to a local file and it's "known good hash"
function check_file {
  actual=($(md5sum "$1"))
  if [[ "$actual" != "$2" ]]; then
    echo "ERROR: $1 did not match it's hash value."
    echo "$actual != $2"
    echo "Possible attack.  Exiting"
    exit 1
  fi
  echo "Validated $1 matches the checksum on file"
}

echo Starting Safety Checks

check_file /mnt/user/myshare/mything b04b917c1f66e52adf2722d35f9b51b6
# about 5 random per share

rclone copy /mnt/user/myshare myremote:/myshare

Like I said, don’t judge too much, but for me it’s a “poor man’s ransomware checker”. If any of those have been modified, do not perform a backup, notify me, and shutdown.