in reply to Re: modified file
in thread modified file

Good point wog, this is particularly true of backups. It is possible for the sysadmin to backup all your files, restore them to a different location and do whatever they want to the copies. This type of activity would leave no trail that you could follow.
@a=split??,'just lose the ego and get involved!';
for(split??,'afqtw{|~'){print $a[ord($_)-97]}

Replies are listed 'Best First'.
Re: Re: Re: modified file
by andreychek (Parson) on Sep 23, 2001 at 05:55 UTC
    Or, taking what you said a different way -- the sysadmin, doing the routine nightly backups, could throw the timestamp off too.. leaving you unsure if it was an automated process which touched the file, or a person manually looking at it.

    Backups, tripwire, the "locate" DB, and several other nightly processes can all interfere with it.
    -Eric