[ale] stat question

[Greg Freemyer]

But I believe opening a file via c code and overwriting pre-existing
data will only update the mtime and not the ctime.

My understanding is ctime tracks updates to the inode, not updates to
the file data.

Greg

On Wed, Mar 31, 2010 at 12:24 PM, Matt Rideout <mrideout at windserve.com> wrote:
> mtime is the last time that the file contents were changed, while ctime
> is the last time that anything else tied to the file's inode were changed.
>
> Running chmod, for example, will update the ctime, but not the mtime.
> Appending something to the file will update both.
>
> Geoffrey wrote:
>> Regarding the stat command what is the difference between:
>>
>> Time of last modification
>> Time of last change
>>
>>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>



-- 
Greg Freemyer
Head of EDD Tape Extraction and Processing team
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
CNN/TruTV AiredForensic Imaging Demo -
   http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com