[lug] File modification

[Jonathan Briggs]

If you've got root on the machine there is no way to prove it.  You 
could have used debugfs to edit the file times by hand.  I believe the 
journal is circular, and is overwritten very quickly so that probably 
won't be any help.

There are three file times: modify time, access time and change time. 
 Change time will probably not help you, but it can be useful to 
determine if someone tried to set the modification time back using 
touch.  Change is set whenever the inode is edited...so any permission 
change, mtime change or file change would set it.

Does the professor know the end time of the running program?  You could 
demonstrate that the program runs for time X, and that program end - X 
was before the deadline.

Chris Riddoch wrote:

>Hi, everyone.
>
>Is there any way to determine that a file wasn't modified besides
>looking at the modification times of a file? I'm aware that 'touch'
>and similar programs can modify the modification times. I'm using an
>ext3 filesystem, and am wondering if the journal might be able to back
>me up. Doesn't it track writes?
>
>I need to demonstrate to a professor that a certain file was not
>modified after a particular time (notably the deadline) for an
>assignment - the program didn't finish running in time, but I *did*
>finish writing it in time, and need to prove it!  I know it's
>technically not *provable*, but I want to find everything I can to
>back me up and just hope he doesn't think I'd try to go in and tweak
>with the file attributes *or* the journal *or* whatever else...
>
>Thanks,
>