Is there a way to tell if a file's date created/modified dates were adjusted artificially via command line. I am talking about for files like Word and Excel documents, so if someone opened and modified a word file on 12/1, but then it was changed to 11/1, is there anyway to see this?

Also does the possibility of this matter what OS the file was created on? I need to know how to do this for OSX, ubuntu, and 7.


  • And what does that mean? Edit: I see, I am not sure if I am supposed to answer that or you are just interjecting with a witty comment. Jan 17 '13 at 18:40

Unless you've enabled auditing, no, you won't be able to see if it's been modified.


Unless you can trust the clock of the system the files are stored on, no, and maybe not even then. I could set the clock back (or forward) in the BIOS, modify the file, restart the system and correct the clock in the BIOS.

  • @pnuts rephrased
    – K.A.Monica
    Jan 18 '13 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.