Hacker News Reader

Comment by rjbwork | Hacker News Reader

Easy to forge creation times.

Unallocated space doesn't have filesystem entries, hence, no file change, access, or modification times.

Worse: many filesystems don't note creation time but change time. I'd have to check what the status is for NTFS (the most likely consumer FS), but that's the case for virtually all Unix-and-similar filesystems: ext3/4, HFS, etc.

EXT3/4 does in fact track creation time, but the Unix-style fstat() doesn't have a field to return creation time. You can use debugfs to retrieve it once you have the inode and device: http://unix.stackexchange.com/questions/50177/birth-is-empty...

NTFS tracks creation time also, and it's available as one of the columns to sort by in Explorer.

The BSDs, Windows, OS X, and Mac OS classic and their corresponding filesystems all supported this for decades. Linux is the only major holdout, because according to Linus, "it's all totally useless and people can't even agree on a name." [1]

[1] https://lwn.net/Articles/397445/

Yet creation time is still useless in this case, because forging it is still trivial [0][1].

A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust.

Without that, and with incentive, this becomes nothing more than a farce.

[0] https://www.howtogeek.com/203154/how-to-change-created-or-mo...

[1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1

Thanks for that. I know that the inode structure doesn't, or at least didn't return this, for a long time (occupational hazard: outliving your education's "best used by" date). Which was why I'd already edited the initial "most" to "many" describing filesystems above (prior to posting).

I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.

Reply on news.ycombinator.com