AIDE can tell you that a Linux file changed, but it cannot tell you whether the change was malicious, approved, or already present when the baseline was created. The database is evidence only when it begins from a known-clean state, stays protected from the host it measures, ...