Re: Re: modified file

[jlongino]

in reply to Re: modified file
in thread modified file

Good point wog, this is particularly true of backups. It is possible for the sysadmin to backup all your files, restore them to a different location and do whatever they want to the copies. This type of activity would leave no trail that you could follow.

@a=split??,'just lose the ego and get involved!';
for(split??,'afqtw{|~'){print $a[ord($_)-97]}

[andreychek]

Or, taking what you said a different way -- the sysadmin, doing the routine nightly backups, could throw the timestamp off too.. leaving you unsure if it was an automated process which touched the file, or a person manually looking at it.

Backups, tripwire, the "locate" DB, and several other nightly processes can all interfere with it.
-Eric