Date: Mon, 26 Jan 2009 22:03:54 -0800
From: Hal Pomeranz <[email protected]>
Reply-To: Eugene Unix and Gnu/Linux User Group <[email protected]>
To: Eugene Unix and Gnu/Linux User Group <[email protected]>
Subject: Re: [Eug-lug] ls script help
...>
# all files, recursively, created within the past 30 days
find . -ctime -30
Bzzt! Incorrect! "ctime" is not "created time", it's "inode change
time"-- i.e., the last time you used chmod/chown/etc on the file.
Let's talk about this a bit.
(it's going somewhat beyond what Mr.O was asking for)
On the unix flavors I have worked on the ctime changes whenever the data
*or* the meta-data of a file have changed. I have not seen a change of
mtime w/o also seeing a corresponding change in ctime with any standard
command. (is it just that I have not seen it, or _?_ ... someone looking
at the source code?)
In addition to chmod and chown, a mv, cp -p, touch, tar -x, rsync(?),
<edit|append>, _what-else_?_ will change the ctime (and the meta-data).
The only type of operation that doesn't change the ctime is reading the
data, which in turn, changes the atime.
So if Mr. O has moved(or tar'ed, gzip'ed,...) old files into the directory
of interest, and still want's to keep them (because they are *new there* )
then the ctime would be indeed the criteria to look at.
In addition to chmod and chown, a mv, cp -p, touch, tar -x,
rsync(?), <edit|append>, _what-else_?_ will change the ctime (and the
meta-data)
In short, I don't see a harm in using the ctime, though I agree it was
the right thing to point out 'c' stands for change, not create.
It seems to me, the ctime is an almost(?) forensic attribute (at least on
the OS level) -- whatever a user/hacker has done to a file, the last
action is recorded in the ctime. Correct?
Conversely, is there any official unix command (or hack for that matter)
that allows you to arbitrarily change the ctime on a life system (anything
beyond throwing a hex editor at an unmounted file system)
.
.
.
For those interested in exploring unix time stamps try
stat fileName [fN2 ...]
If you like python try
os.stat('fileName')
- Horst
_______________________________________________
EUGLUG mailing list
[email protected]
http://www.euglug.org/mailman/listinfo/euglug
