MAC times
In computer terminology, MAC times are times of latest modification, access and change of status or creation of a file.
| Contents |
Linux and unix MAC times
Modification time (mtime) is time files contents were changed. For example, you can change modification time of text file by writing some text to it and saving it.
Access time (atime) is the time file was viewed. You can change access time by viewing a file: less foo.txt.
Change time (ctime) is the time of last change of file status, such as permissions or ownership. For example, chmod og-rwx foo.txt updates change time of foo.txt.
Windows MAC times
Windows (using the later FAT32 or NTFS file systems) stores creation, modification, and access times of a file. Modification means a change of file content, access time is the time file was viewed. Since Windows Explorer opens many files in order to determine whether they contain an icon that can be used to represent them, this can cause a significant performance overhead. This behaviour can be suppressed in NTFS, but involves editing the registry.
References
- Casey: Computer Crime Investigation. Luque: Logical Level Analyses of Linux Systems: p 182-183. Sheldon: Forensic Analyses of Windows Systems p 134-135. ISBN 0-12-163103-6.