GEEK: What does the date on a system file mean?

[archerships]

"What does the date on a system file mean? For example, a 18 Dec 2001 timestamp doesn't necessarily mean that the file was installed on 18 Dec 2001?"

Per my co-worker Ed:

I believe it is the last time the file was modified (and the install process does not modify files, only installs them). So, for example: An Apple Engineer would compile the shared-object adaptor and then copy it to the final system destination. That last copy phase is the modification timestamp. Then in making the installer package that file is scanned and placed in an archive file, but is not otherwise modified either content-wise or timestamp-wise. So, the date you see is the date that the Apple Engineer compiled and installed it on the system from which the install package was made.

There are three timestamps on a unix type file system. For example:

cd /System/Library/WebObjects/Adaptors/Apache
stat -x mod_WebObjects.so

gives:

File: "mod_WebObjects.so"
Size: 143536 FileType: Regular File
Mode: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ wheel)
Device: 14,2 Inode: 426083 Links: 1
Access: Thu Aug 31 14:44:09 2006
Modify: Wed Dec 19 14:13:48 2001
Change: Thu Aug 31 14:44:09 2006

So, there are Access, Modified and Change times. The Modify time is the one commonly shown in "ls -l". The "Change" time is probably the time it was installed.

Comments

[crabbyolbastard.livejournal.com]

Umm the last time the file was tampered with by the NSA and the date to which they set it so as to hide the evidence it was tampered with?