Artificial truth

The more you see, the less you believe.

[archives] [latest] | [homepage] | [atom/rss/twitter]

About ctime and mtime
Mon 17 June 2013 — download

Occasionally, I receive some emails about MAT. Sometimes thanks, more often bug reports (lies !), and from time to time suggestions.

Someone asked me about timestamps. Why MAT doesn't support ctime/mtime/atime ?

What are they ?

UNIX keeps 3 timestamps for each file:

  • atime : time of last access, updated every time the file is read.
  • ctime : time of change (and not creation), update every time the file, or it's metadata (owner, group, mode, ...).
  • mtime : time of last modification, updated every time the file's content is modified.

Most of the time, ctime is equal to mtime.

So, MAT supports them, right ?

No, not by design. This is only a side effect. When MAT process a file, it always updates ctime, mtime and time.

Please don't be confused by the fact that certain fileformat metadata includes creation time and modification time. Those metadata are handled by MAT, and this time, by design :)