On 10/22/2011 04:14 PM, Mark Sandrock wrote:
I found something interesting with the .ppt file. Apparently, just
opening a .ppt file (not saving though) from MS Office will change bytes
in the file and not update the modification time. I was able to
duplicate the changes to an arbitrary PPT file (actually it was more
than one byte when I looked closer). The MS-PPT spec shows it to be a
section related to the current user's profile. The interesting thing is
that it kept the length the same, changed bytes, but didn't update the
Windows modify time. If I mark the file read-only, it doesn't get
changed of course but in both cases, there was no indication from the UI
of a change to the file. The Unix stat command for this file shows:
Why don't you see which byte differs, and how it does?
Maybe that would suggest the "failure mode". Is it the
same byte data in all affected files, for instance?
Access: 2011-10-22 18:59:39.671340999 -0500
Modify: 2010-01-12 21:15:07.456360000 -0600
Change: 2011-03-09 20:16:22.094604104 -0600
I originally thought the change date of 2011-03-09 corresponded to some
permission changes I made on that folder but that is around the time I
would have last opened the file. So the mystery solved for that one.
Now on to find out why the 3 Acronis Backup files got modified. This is
good news so far...
zfs-discuss mailing list