On platforms where there is a timestamp for when a
file was last viewed (includes most UNIX systems)
you can check the access timestamp
returned by stat or -A. Note that this
timestamp can be manipulated, and that the sysadmin
may be able to bypass the timestamping mechanism entirely.
Good point wog, this is particularly true of backups. It
is possible for the sysadmin to backup all your files,
restore them to a different location and do whatever they
want to the copies. This type of activity would leave no
trail that you could follow.
@a=split??,'just lose the ego and get involved!';
for(split??,'afqtw{|~'){print $a[ord($_)-97]}
Or, taking what you said a different way -- the sysadmin, doing the routine nightly backups, could throw the timestamp off too.. leaving you unsure if it was an automated process which touched the file, or a person manually looking at it.
Backups, tripwire, the "locate" DB, and several other nightly processes can all interfere with it.
-Eric