Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to tell if a file's date created/modified dates were adjusted artificially via command line. I am talking about for files like Word and Excel documents, so if someone opened and modified a word file on 12/1, but then it was changed to 11/1, is there anyway to see this?

Also does the possibility of this matter what OS the file was created on? I need to know how to do this for OSX, ubuntu, and 7.

Thanks.

share|improve this question
2  
ah but Quis custodiet ipsos custodes? –  pnuts Jan 17 '13 at 18:40
    
And what does that mean? Edit: I see, I am not sure if I am supposed to answer that or you are just interjecting with a witty comment. –  DOTang Jan 17 '13 at 18:40
    
Sorry if confusing (I was trying to be brief). Your comment is a fine 'answer' to mine. –  pnuts Mar 27 '13 at 12:51

2 Answers 2

up vote 2 down vote accepted

Unless you've enabled auditing, no, you won't be able to see if it's been modified.

share|improve this answer

Unless you can trust the clock of the system the files are stored on, no, and maybe not even then. I could set the clock back (or forward) in the BIOS, modify the file, restart the system and correct the clock in the BIOS.

share|improve this answer
    
@pnuts rephrased –  K.A Jan 18 '13 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.