I'm using merge cap to create a merge pcap file from 15 files. For the merged file, I have changed the name to that of the first of the 15 files. But I would also like to change the merged file's attributes like "Date Created" and "Last Modified" to that of the first one. Is there anyway to do this?

FILES_dcn=($(find  $dir_dcn -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $9}'))
TAG1_dcn=$(basename "${FILES_dcn[14]}" | sed 's/.pcap//')
mergecap -w  "${dir_dcn}"/merge_dcn.pcap "${FILES_dcn[@]}"
mv  "${dir_dcn}"/merge_dcn.pcap  "${dir_dcn}"/"${TAG1_dcn}".pcap

I try to access the merged files over a samba server (Ubuntu). So that an extractor function can access auto extract the files to D folder. But as the created date will be changed for the merged file the extraction fails. Is there anyway to fix this?


You can use the touch command along with the -r switch to apply another file's attributes to a file.

NOTE: There is no such thing as creation date in Unix, there are only access, modify, and change. See this U&L Q&A titled: get age of given file for further details.

$ touch -r goldenfile newfile


For example purposes here's a goldenfile that was created with some arbitrary timestamp.

$ touch -d 20120101 goldenfile
$ ls -l goldenfile 
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now I make some new file:

$ touch newfile
$ ls -l newfile 
-rw-rw-r--. 1 saml saml 0 Mar  7 09:06 newfile

Now apply goldenfile's attributes to newfile.

$ touch -r goldenfile newfile 
$ ls -l goldenfile newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now newfile has the same attributes.

Modify via Samba

I just confirmed that I'm able to do this using my Fedora 19 laptop which includes version 1.16.3-2 connected to a Thecus N12000 NAS (uses a modified version of CentOS 5.x).

I was able to touch a file as I mentioned above and it worked as I described. Your issue is likely a problem with the either the mounting options being used, which may be omitting the tracking of certain time attributes, or perhaps it's related to one of these bugs:

  • @JishnuUNair - can you check to see how the Samba share is being mounted (with what options)? You can typically get these from the mount command and then look for the share you're accessing. Just a guess but it's likely being mounted use gvfs as a FUSE filesystem. – slm Mar 7 '14 at 15:50
  • 1
    A lot of filesystems now support a file creation time. For ext4, you can view/change it through debugfs (although this needs root privileges and is no use here). See this question - unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4 – Graeme Mar 7 '14 at 17:07
  • @Graeme - yes I'd just referenced a similar method using stap: unix.stackexchange.com/questions/91197/… in the chatroom. – slm Mar 7 '14 at 17:22
  • 1
    While Linux does not support a creation time, a Samba share can. Depending on how you set it up (and xattr support in the file system), Samba has the ability to store some time stamps in Linux xattrs. That means it may be able to do things that the underlying file system cannot - like report a valid (modifiable) creation time. Sorry, I didn't find any good links to how this works. – Peter May 30 '14 at 5:27
  • 1
    Actually most Linux file systems (eg. ext4) now support creation date, and Linux 4.11 will have a statx() call to retrieve it. Finally. – Jez Mar 10 '17 at 16:18

Easiest way - accessed modified will be the same:

touch -a -m -t 201512180130.09 fileName.ext


-a = accessed
-m = modified
-t  = timestamp - use [[CC]YY]MMDDhhmm[.ss] time format

If you wish to use NOW just drop the t and the timestamp

To verify they are all the same: stat fileName.ext

See: touch man

  • 5
    Somehow on ubuntu 14.04 putting -a before -m does not modify access time...put it after, so: touch -m -a -t.... – Jadeye Jan 28 '16 at 13:25
  • 5
    -d time_string maybe easier than -t: -d "2004-02-29 16:21:42" – yurenchen Nov 14 '17 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.