Suggestion to be sneaky

[jonchristmas]

If it were me I would parse the timestamp on the edited files and use touch -d to set the timestamp on the file so it doesnt show up as a recently modified file. Additionally you can set created files timestamps using something like touch -r /etc/pam.d createdpythonfiles.py
Just thought i would share that incase you wanted to make it harder to notice.