I have been using
touch -t to change time of a file when I started using Linux, is there any mitigation against
touch date/time forgery?
Like, echoing original created date and time, even after using touch.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
See this stackoverflow answer:
You can fetch the creation time using
debugfs but you'll need root permissions to do so. I also think that not all filesystems store this in the indode structure. All that is guaranteed to be there is the inode change time (ctime), file modification time (mtime) and last access time (atime, and this isn't guaranteed to be right if the filesystem is mounted with
The modification time of a file can be freely chosen by the owner of the file. You can check the file's inode change time (ctime): that one can only ever be set to the current time, and any modification of the file's metadata such as changing the mtime resets the ctime to the current time.
If you want to check whether a file hasn't changed since a certain date, you can check its ctime. But the ctime could be more recent for non-nefarious reasons, such as a change of attributes, a moved or copied file, a restore from backup, …
Of course the root user can bypass this by changing the system time or manipulating the file directly.
The reliable way of testing the state of a file at a certain time in the past is to consult a snapshot or backup made at that time.