Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to tell if a file's date created/modified dates were adjusted artificially via command line. I am talking about for files like Word and Excel documents, so if someone opened and modified a word file on 12/1, but then it was changed to 11/1, is there anyway to see this?

Also does the possibility of this matter what OS the file was created on? I need to know how to do this for OSX, ubuntu, and 7.


share|improve this question
ah but Quis custodiet ipsos custodes? – pnuts Jan 17 '13 at 18:40
And what does that mean? Edit: I see, I am not sure if I am supposed to answer that or you are just interjecting with a witty comment. – DOTang Jan 17 '13 at 18:40
Sorry if confusing (I was trying to be brief). Your comment is a fine 'answer' to mine. – pnuts Mar 27 '13 at 12:51
up vote 2 down vote accepted

Unless you've enabled auditing, no, you won't be able to see if it's been modified.

share|improve this answer

Unless you can trust the clock of the system the files are stored on, no, and maybe not even then. I could set the clock back (or forward) in the BIOS, modify the file, restart the system and correct the clock in the BIOS.

share|improve this answer
@pnuts rephrased – K.A Jan 18 '13 at 0:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .