http://www.perlmonks.org?node_id=114123


in reply to Re: Re: modified file
in thread modified file

Or, taking what you said a different way -- the sysadmin, doing the routine nightly backups, could throw the timestamp off too.. leaving you unsure if it was an automated process which touched the file, or a person manually looking at it.

Backups, tripwire, the "locate" DB, and several other nightly processes can all interfere with it.
-Eric