MAC times

MAC or MACtime stands for " modification", "access" and "metadata change" or "creation time" and said three timestamps, which are used in file systems to log file operations. The wide common name MACtime originally comes from Dan Farmer, who wrote a program with the same name.

The three kinds of time stamps

Basically there are three different values ​​and interprets it as follows:

Modification stamp ( mtime )

The mtime indicates when the contents of a file was last modified. However, since not distinguish most file systems, if the content was previously exist or was inserted identical overwrites a file operation with the same content in the same file the modification timestamp as well, even though the file has not actually changed.

Access stamps ( atime)

The access atime stamp or indicate when a file was opened for the last time to read them. A program can already open a file, but reading the contents only later. This can lead to differences between the open and read a file. The atime is also updated as well, even if only a very small amount file is read ( eg meta information like width and height of an image).

Change or Creation stamp ( ctime )

There are fundamental differences between Windows and Unix:

• Change: On Unix systems, historically changed the ctime when the metadata of a file (eg, rights, owners, ..) and not the actual content is changed.
• Creation: In windows- like systems, the ctime is the birth time of a file interpreted (eg: This file was created December 12, 2011 at 12:31 clock ).

This difference can lead to an incorrect representation of the file time on different operating systems. Most Unix file systems do not store Creation stamps and limited to the Change - stamp; However, save some file systems, both values ​​( eg NTFS, HFS , ZFS, or UFS2 ).

Trivia

Special consideration of these values ​​can be found in the evaluation of computers by means of computer forensics.