On Mon, Aug 2, 2010 at 18:08, Ben Scott <[email protected]> wrote: > On Mon, Aug 2, 2010 at 8:48 PM, Kurt Buff <[email protected]> wrote: >> (my choice of atime, mtime or ctime) > > Those Unix concepts don't exist one-to-one in Windows.
Yeah, but those are the terms that stick in my mind. Funny how that works when you're exposed to the *nix virus, even after having started with Windows oh so many years ago. > atime is last accessed, Windows does that pretty much the same thing, > as "Last accessed". > > mtime is last data modification (i.e., file contents). ctime is last > change to inode. Changes to mtime always touch the ctime as well. > Changes to some other things (such as permission mode) only touch the > ctime. > > The Windows "Last modified" time is something more than mtime, prolly > closer to ctime, but I think there are things you can do in a > directory in Windows which don't touch the "Last modified" time which > would on *nix. (I could be wrong, but Windows has a bajillion > different ways to access files, so hard to prove non-existence.) > > Windows also has a "Creation" time, date/time file was created in > filesystem. There's no standard implementation of that on *nix. > > When Windows copies a file, it generally preserves the "Last modified" > time to match the original, but the "Creation" time is the time of the > copy. Looking for files with a recent "Creation" time may help you in > your case. > > The GUI can search for files by "Creation". I don't know of a > command-line tool off the top of my head. Creation time is what I was looking for. I've been looking at powershell for the past 10 minutes, and it may have a better answer for me. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
