convenient.email

Ext4 has btime which might be what you thought ctime was
But of course, file creation is hard to quantify


[bookmark=https://twitter.com/cyb3rops/status/1269933799858724868]Popular # misbelief

While on a UNIX/Linux system `atime` is the last access timestamp & `mtime` is the last time the content was modified, `ctime` isn't the timestamp when the file was created

It indicates when the attributes of a file have been changed (eg. chmod +x)[/bookmark]
#DFIR
Silver Dragon Mountain
Later posts Earlier posts