How do Unix Timestamps work?
Unix stores two times for every file, the last modification time of the file and the last access time of the file.
`ls -lT` displays the last modification time of files.
`ls -lTu` displays the last access time of files.
To edit these times, you will need a program like SaintStat or fix.c. These programs are normally packaged with rootkit's.
You can write your own utility to modify timestamps fairly easily using the utime function of C or PERL.
The purpose of editing timestamps is usually to modify files without making them look as if they have been modified. This technique won't fool a message digest algorithm like MD5.
Purchase these excellent books on Unix security and administration at Amazon.com
|
|
|
Bookmark How do Unix Timestamps work?
