Occasionally, I receive some emails about MAT. Sometimes thanks, more often bug reports (lies !), and from time to time suggestions.
Someone asked me about timestamps. Why MAT doesn't support ctime/mtime/atime ?
UNIX keeps 3 timestamps for each file:
- atime : time of last access, updated every time the file is read.
- ctime : time of change (and not creation), update every time the file, or it's metadata (owner, group, mode, ...).
- mtime : time of last modification, updated every time the file's content is modified.
Most of the time, ctime is equal to mtime.
No, not by design. This is only a side effect. When MAT process a file, it always updates ctime, mtime and time.
Please don't be confused by the fact that certain fileformat metadata includes creation time and modification time. Those metadata are handled by MAT, and this time, by design :)