On Mon, Aug 2, 2010 at 8:48 PM, Kurt Buff <[email protected]> wrote: > (my choice of atime, mtime or ctime)
Those Unix concepts don't exist one-to-one in Windows. atime is last accessed, Windows does that pretty much the same thing, as "Last accessed". mtime is last data modification (i.e., file contents). ctime is last change to inode. Changes to mtime always touch the ctime as well. Changes to some other things (such as permission mode) only touch the ctime. The Windows "Last modified" time is something more than mtime, prolly closer to ctime, but I think there are things you can do in a directory in Windows which don't touch the "Last modified" time which would on *nix. (I could be wrong, but Windows has a bajillion different ways to access files, so hard to prove non-existence.) Windows also has a "Creation" time, date/time file was created in filesystem. There's no standard implementation of that on *nix. When Windows copies a file, it generally preserves the "Last modified" time to match the original, but the "Creation" time is the time of the copy. Looking for files with a recent "Creation" time may help you in your case. The GUI can search for files by "Creation". I don't know of a command-line tool off the top of my head. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
