[lug] File modification
zlynx at acm.org
Wed Mar 13 16:04:27 MST 2002
If you've got root on the machine there is no way to prove it. You
could have used debugfs to edit the file times by hand. I believe the
journal is circular, and is overwritten very quickly so that probably
won't be any help.
There are three file times: modify time, access time and change time.
Change time will probably not help you, but it can be useful to
determine if someone tried to set the modification time back using
touch. Change is set whenever the inode is edited...so any permission
change, mtime change or file change would set it.
Does the professor know the end time of the running program? You could
demonstrate that the program runs for time X, and that program end - X
was before the deadline.
Chris Riddoch wrote:
>Is there any way to determine that a file wasn't modified besides
>looking at the modification times of a file? I'm aware that 'touch'
>and similar programs can modify the modification times. I'm using an
>ext3 filesystem, and am wondering if the journal might be able to back
>me up. Doesn't it track writes?
>I need to demonstrate to a professor that a certain file was not
>modified after a particular time (notably the deadline) for an
>assignment - the program didn't finish running in time, but I *did*
>finish writing it in time, and need to prove it! I know it's
>technically not *provable*, but I want to find everything I can to
>back me up and just hope he doesn't think I'd try to go in and tweak
>with the file attributes *or* the journal *or* whatever else...
More information about the LUG