Responding to this part of your update:

a guy ask me if a file content with different content but same name, same date/time, same size, what will happen

To clarify: the question here is: "what if the content of a particular file happens to change, while its name, its size and its modification date all remain unchanged?"

If that is a correct restatement of the question, I think the answer would be that this could only arise from two possible things happening:

1. There has been some damage or corruption to the hard disk, altering the data content of the blocks allocated to this file, or
2. Someone alters the file contents in some normal way (which changes the modification time in its directory entry), and then deliberately uses the unix "touch" command to reset the modification date to its previous value.

Apart from those two things, I don't know of any way for file contents to change without altering the modification time/date field in the file's directory entry.

Usually, if the first type of problem happens, it has a much wider impact (e.g. the whole disk becomes non-functional). As for the second type of problem, if you really do have to watch out for that sort of trickery, then you certainly do want to maintain checksums on all data files (and take extra steps to protect the checksum list from unauthorized access).

If there isn't a plausible risk of the latter sort of problem, then just checking directory trees with "find", looking for recently modified files, should suffice.