Today's article has us finding out when a file was created...

KGIII

Super Moderator
Staff member
Gold Supporter
Joined
Jul 23, 2020
Messages
11,497
Reaction score
9,994
Credits
95,326
This can be handier than one might first think. It's also in the terminal, though there's likely a GUI way to do this in your file manager.


Feedback is awesome.
 


I can think of one use, that is if a sound recoding would be permitted as evidence in Court and an allegation that a file has been tampered with. I guess if ls -l shows creation date at the time it was created that might be sufficient to show the file is original ?
 
I am sure it gets used for forensic purposes. Unless there's evidence of tampering, like the file modification date, it should be sufficient for evidentiary purposes.
 
There is a difference between ls -al output and "Birth" of the file:
Code:
[yips@ops ~]$ ls -al ipaddrlog.txt
-rw-r--r-- 1 yips yips 462 Jun 18 20:28 ipaddrlog.txt
compared to:
Code:
[yips@ops ~]$ stat ipaddrlog.txt
  File: ipaddrlog.txt
  Size: 462             Blocks: 8          IO Block: 4096   regular file
Device: 814h/2068d      Inode: 14685763    Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/     yips)   Gid: ( 1000/     yips)
Access: 2022-07-14 13:30:56.906664959 +1000
Modify: 2022-06-18 20:28:39.466996107 +1000
Change: 2022-06-18 20:28:39.466996107 +1000
 Birth: 2021-09-15 09:51:30.696720519 +1000
 
Nice. You should definitely add that as a comment.
 
this is what i get with stat on vanilla Arch :

Code:
[andrew@darkstar:~/Desktop][1]$ stat --printf='%T' myfile.txt             (07-25 08:50)
device  2052
inode   683065
mode    33188
nlink   1
uid     1000
gid     1000
rdev    0
size    6
atime   1658734760
mtime   1658734760
ctime   1658734760
blksize 4096
blocks  8
link
[andrew@darkstar:~/Desktop]$         
[andrew@darkstar:~/Desktop]$ which stat                                           (07-25 08:51)
stat: shell built-in command
[andrew@darkstar:~/Desktop]$
 
captain-sensible's code output included:
Code:
....
atime   1658734760
mtime   1658734760
ctime   1658734760
....
This output about "myfile.txt" appears to show that file access time, modification time and change-of-file-attributes time are all the same, which one would expect of a file written once and not subsequently altered. What would the result look like for a file that was written, modified at a later time, and perhaps underwent a change of attributes?
 
strange one, file was on my Desktop , so i assumed didn't need sudo ..but ...
Code:
[andrew@darkstar:~/Desktop]$ sudo stat --printf="%w" myfile.txt           (07-26 09:54)
[sudo] password for andrew:
2022-07-25 08:39:20.060910414 +0100%
 

Members online


Latest posts

Top