2

Say there is an empty directory and I run the commands >file1 and touch file2 while in that directory, but I forget which command created which file.

I don't know what command I ran first and I don't have access to command history.

The files are untampered. Is there a way to tell which file was obtained from touch and what file was obtained from redirection?

7
  • 2
    I don't think there is a way other than using command history. I also don't think you should ever really need this information.
    – jesse_b
    May 8, 2019 at 14:38
  • Is this an interview question? Just curious.
    – Atul
    May 8, 2019 at 14:42
  • check audit logs if you have it and enabled before, and how you don't have access to command history ?!
    – αғsнιη
    May 8, 2019 at 14:42
  • The creation time of both files will maybe be different.
    – Jules Lamur
    May 8, 2019 at 15:01
  • @Atul Nope. (filler)
    – Redirect
    May 8, 2019 at 15:06

2 Answers 2

Reset to default
6

No, there will be no difference in the resulting files.

2
  • 3
    @Kevdog777 How's this not an answer?
    – Redirect
    May 8, 2019 at 15:10
  • 7
    Did not mean to critique or request clarification. My answer is a precise answer to the actual question, and it was meant as such.
    – Hkoof
    May 8, 2019 at 15:14
1

@Hkoof is correct.

Neither :> nor touch actually create files, they only send requests to the underlying management system which populates the attributes with the information it needs, and these are the built-in attributes concerned only with managing the files and their security (who, when, what is allowed to be done etc).

There is no built-in attribute which can be set to record how the 'creation process' was started simply because this information has no use in the management of the system. The how in file creation is the responsibility of the user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .