73

I'm using merge cap to create a merge pcap file from 15 files. For the merged file, I have changed the name to that of the first of the 15 files. But I would also like to change the merged file's attributes like "Date Created" and "Last Modified" to that of the first one. Is there anyway to do this? 

FILES_dcn=($(find  $dir_dcn -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $9}'))
TAG1_dcn=$(basename "${FILES_dcn[14]}" | sed 's/.pcap//')
mergecap -w  "${dir_dcn}"/merge_dcn.pcap "${FILES_dcn[@]}"
mv  "${dir_dcn}"/merge_dcn.pcap  "${dir_dcn}"/"${TAG1_dcn}".pcap

I try to access the merged files over a samba server (Ubuntu). So that an extractor function can access auto extract the files to D folder. But as the created date will be changed for the merged file the extraction fails. Is there anyway to fix this?

Improve this question

3 Answers 3

Reset to default
117

You can use the touch command along with the -r switch to apply another file's attributes to a file.

NOTE: There is no such thing as creation date in Unix, there are only access, modify, and change. See this U&L Q&A titled: get age of given file for further details.

$ touch -r goldenfile newfile

Example

For example purposes here's a goldenfile that was created with some arbitrary timestamp.

$ touch -d 20120101 goldenfile
$ ls -l goldenfile 
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now I make some new file:

$ touch newfile
$ ls -l newfile 
-rw-rw-r--. 1 saml saml 0 Mar  7 09:06 newfile

Now apply goldenfile's attributes to newfile.

$ touch -r goldenfile newfile 
$ ls -l goldenfile newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now newfile has the same attributes.

Modify via Samba

I just confirmed that I'm able to do this using my Fedora 19 laptop which includes version 1.16.3-2 connected to a Thecus N12000 NAS (uses a modified version of CentOS 5.x).

I was able to touch a file as I mentioned above and it worked as I described. Your issue is likely a problem with the either the mounting options being used, which may be omitting the tracking of certain time attributes, or perhaps it's related to one of these bugs:

Improve this answer
6
  • 1
    @JishnuUNair - can you check to see how the Samba share is being mounted (with what options)? You can typically get these from the mount command and then look for the share you're accessing. Just a guess but it's likely being mounted use gvfs as a FUSE filesystem.
    – slm ♦
    Mar 7, 2014 at 15:50
  • 2
    A lot of filesystems now support a file creation time. For ext4, you can view/change it through debugfs (although this needs root privileges and is no use here). See this question - unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4
    – Graeme
    Mar 7, 2014 at 17:07
  • 1
    @Graeme - yes I'd just referenced a similar method using stap: unix.stackexchange.com/questions/91197/… in the chatroom.
    – slm ♦
    Mar 7, 2014 at 17:22
  • 2
    While Linux does not support a creation time, a Samba share can. Depending on how you set it up (and xattr support in the file system), Samba has the ability to store some time stamps in Linux xattrs. That means it may be able to do things that the underlying file system cannot - like report a valid (modifiable) creation time. Sorry, I didn't find any good links to how this works.
    – Peter
    May 30, 2014 at 5:27
  • 2
    Actually most Linux file systems (eg. ext4) now support creation date, and Linux 4.11 will have a statx() call to retrieve it. Finally.
    – Jez
    Mar 10, 2017 at 16:18
65

Easiest way - accessed modified will be the same:

touch -a -m -t 201512180130.09 fileName.ext

Where:

-a = accessed
-m = modified
-t  = timestamp - use [[CC]YY]MMDDhhmm[.ss] time format

If you wish to use NOW just drop the t and the timestamp

To verify they are all the same: stat fileName.ext

See: touch man

Improve this answer
2
  • 8
    Somehow on ubuntu 14.04 putting -a before -m does not modify access time...put it after, so: touch -m -a -t....
    – Jadeye
    Jan 28, 2016 at 13:25
  • 7
    -d time_string maybe easier than -t: -d "2004-02-29 16:21:42"
    – yurenchen
    Nov 14, 2017 at 10:42
0

The easiest way you can do ...

Suppose you

change date and time

of meta data of your file.

When your teacher sees this, if she or he/she is smart, she will notice your cheating by 0x.000000000 this nano seconds.

So, What do we can do?

All you have to do is put back your date and time of your system to any date and time you want, create again your file with touch command or anything and edit it content.

enter image description here

Now send this file to him/her.

Good Luck.

Improve this answer
4
  • 2
    There is no need to change system time. Look at the touch command -r and -t options to be able to specify any timestamp you want instead of current time of day.
    – Patrick Mevzek
    May 25, 2021 at 16:29
  • This was a good thing, although the Internet is a place full of different ideas. @PatrickMevzek
    – Amin Seifi
    May 25, 2021 at 16:44
  • What command did you run to get the info in the first screencap?
    – Arthur Bowers
    Feb 22, 2022 at 9:47
  • When this site became a source of information for cheating teachers? We better have more noble objectives to aspire in life.
    – DrBeco
    Feb 24, 2022 at 2:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .