I have been using touch -t to change time of a file when I started using Linux, is there any mitigation against touch date/time forgery?

Like, echoing original created date and time, even after using touch.


See this stackoverflow answer:

You can fetch the creation time using debugfs but you'll need root permissions to do so. I also think that not all filesystems store this in the indode structure. All that is guaranteed to be there is the inode change time (ctime), file modification time (mtime) and last access time (atime, and this isn't guaranteed to be right if the filesystem is mounted with noatime).

  • My question was to find creation, modification and accessed D/T of a file, not a drive as you have mentioned here – Ruban Savvy Dec 5 '13 at 6:29
  • @RubanSavvy Read the specific answer I posted. You aren't getting creation time of the drive. You are getting creation time of the first inode belonging to the file, which is the creation time of the file, which is what you asked. – casey Dec 5 '13 at 6:31
  • Yes I got +1 for ya , is there any easy way to do it? – Ruban Savvy Dec 5 '13 at 6:36
  • 1
    crtime is the time you want, creation time of the inode (thus the file). Note as I mentioned, this is an non-standard extension of POSIX so is not guaranteed to be present on all fs types. The other times (c|m|a)time are the times provided by ls or stat, none of which can tell you about file creation. – casey Dec 5 '13 at 6:41
  • 1
    ctime is the time the 'status information' of the file changed. This will be updated anytime the inode is updated, file permissions are changed, change the owner, file size changes, etc. crtime is when the inode was created. – casey Dec 5 '13 at 6:55

The modification time of a file can be freely chosen by the owner of the file. You can check the file's inode change time (ctime): that one can only ever be set to the current time, and any modification of the file's metadata such as changing the mtime resets the ctime to the current time.

If you want to check whether a file hasn't changed since a certain date, you can check its ctime. But the ctime could be more recent for non-nefarious reasons, such as a change of attributes, a moved or copied file, a restore from backup, …

Of course the root user can bypass this by changing the system time or manipulating the file directly.

The reliable way of testing the state of a file at a certain time in the past is to consult a snapshot or backup made at that time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.