[ale] Modification Date

Greg Freemyer greg.freemyer at gmail.com
Wed Mar 14 11:16:53 EDT 2007


On 3/14/07, Charles Shapiro <hooterpincher at gmail.com> wrote:
> touch <filename> will change the modification date to the current date.
>
>  "touch --t 195502171433 filename" will change the access and modification
> times to February 17, 1955 at 2:30 in the afternoon. Other options will
> change only the access time.
>
>  The creation time (given by "ls -lc") will remain unchanged. Hence:

To be pedantic, linux does not maintain file creation time.  See man stat()

>>
    time_t        st_atime;    /* time of last access */
    time_t        st_mtime;    /* time of last modification */
    time_t        st_ctime;    /* time of last status change */
<<

Quoting wikipedia:

"Note, that ctime is not the time of file creation. Overwriting a file
changes mtime, ctime as well as atime. A change in file permissions or
file ownership changes ctime and atime. "

Greg
-- 
Greg Freemyer
The Norcross Group
Forensics for the 21st Century



More information about the Ale mailing list