3 ms·

Easy to forge creation times.

by rjbwork 10y ago

dredmorbius 10y ago
Unallocated space doesn't have filesystem entries, hence, no file change, access, or modification times. Worse: many filesystems don't note creation time but change time. I'd have to check what the status is for NTFS (the most likely consumer FS), but that's the case for virtually all Unix-and-similar filesystems: ext3/4, HFS, etc.
- barrkel 10y ago
  EXT3/4 does in fact track creation time, but the Unix-style fstat() doesn't have a field to return creation time. You can use debugfs to retrieve it once you have the inode and device: http://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/50184#50184 http://unix.stackexchange.com/questions/50177/birth-is-empty... NTFS tracks creation time also, and it's available as one of the columns to sort by in Explorer.
  - 0x09 10y ago
    The BSDs, Windows, OS X, and Mac OS classic and their corresponding filesystems all supported this for decades. Linux is the only major holdout, because according to Linus, "it's all totally useless and people can't even agree on a name." [1] [1] https://lwn.net/Articles/397445/ https://lwn.net/Articles/397445/
    - shakna 10y ago
      Yet creation time is still useless in this case, because forging it is still trivial [0][1]. A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust. Without that, and with incentive, this becomes nothing more than a farce. [0] https://www.howtogeek.com/203154/how-to-change-created-or-modified-timestamps-for-files-and-folders/ https://www.howtogeek.com/203154/how-to-change-created-or-mo... [1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1 https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1
  - dredmorbius 10y ago
    Thanks for that. I know that the inode structure doesn't, or at least didn't return this, for a long time (occupational hazard: outliving your education's "best used by" date). Which was why I'd already edited the initial "most" to "many" describing filesystems above (prior to posting). I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.

Easy to forge creation times.

by rjbwork 10y ago

Easy to forge creation times.

Unallocated space doesn't have filesystem entries, hence, no file change, access, or modification times. Worse: many filesystems don't note creation time but change time. I'd have to check what the status is for NTFS (the most likely consumer FS), but that's the case for virtually all Unix-and-similar filesystems: ext3/4, HFS, etc.

barrkel 10y ago
EXT3/4 does in fact track creation time, but the Unix-style fstat() doesn't have a field to return creation time. You can use debugfs to retrieve it once you have the inode and device: http://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/50184#50184 http://unix.stackexchange.com/questions/50177/birth-is-empty... NTFS tracks creation time also, and it's available as one of the columns to sort by in Explorer.
- 0x09 10y ago
  The BSDs, Windows, OS X, and Mac OS classic and their corresponding filesystems all supported this for decades. Linux is the only major holdout, because according to Linus, "it's all totally useless and people can't even agree on a name." [1] [1] https://lwn.net/Articles/397445/ https://lwn.net/Articles/397445/
  - shakna 10y ago
    Yet creation time is still useless in this case, because forging it is still trivial [0][1]. A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust. Without that, and with incentive, this becomes nothing more than a farce. [0] https://www.howtogeek.com/203154/how-to-change-created-or-modified-timestamps-for-files-and-folders/ https://www.howtogeek.com/203154/how-to-change-created-or-mo... [1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1 https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1
- dredmorbius 10y ago
  Thanks for that. I know that the inode structure doesn't, or at least didn't return this, for a long time (occupational hazard: outliving your education's "best used by" date). Which was why I'd already edited the initial "most" to "many" describing filesystems above (prior to posting). I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.