76

I'm using merge cap to create a merge pcap file from 15 files. For the merged file, I have changed the name to that of the first of the 15 files. But I would also like to change the merged file's attributes like "Date Created" and "Last Modified" to that of the first one. Is there anyway to do this? 

FILES_dcn=($(find  $dir_dcn -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $9}'))
TAG1_dcn=$(basename "${FILES_dcn[14]}" | sed 's/.pcap//')
mergecap -w  "${dir_dcn}"/merge_dcn.pcap "${FILES_dcn[@]}"
mv  "${dir_dcn}"/merge_dcn.pcap  "${dir_dcn}"/"${TAG1_dcn}".pcap

I try to access the merged files over a samba server (Ubuntu). So that an extractor function can access auto extract the files to D folder. But as the created date will be changed for the merged file the extraction fails. Is there anyway to fix this?

Jishnu U Nair
  • 1,541

3 Answers3

120

You can use the touch command along with the -r switch to apply another file's attributes to a file.

NOTE: There is no such thing as creation date in Unix, there are only access, modify, and change. See this U&L Q&A titled: get age of given file for further details.

$ touch -r goldenfile newfile

Example

For example purposes here's a goldenfile that was created with some arbitrary timestamp.

$ touch -d 20120101 goldenfile
$ ls -l goldenfile 
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now I make some new file:

$ touch newfile
$ ls -l newfile 
-rw-rw-r--. 1 saml saml 0 Mar  7 09:06 newfile

Now apply goldenfile's attributes to newfile.

$ touch -r goldenfile newfile 
$ ls -l goldenfile newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 newfile
-rw-rw-r--. 1 saml saml 0 Jan  1  2012 goldenfile

Now newfile has the same attributes.

Modify via Samba

I just confirmed that I'm able to do this using my Fedora 19 laptop which includes version 1.16.3-2 connected to a Thecus N12000 NAS (uses a modified version of CentOS 5.x).

I was able to touch a file as I mentioned above and it worked as I described. Your issue is likely a problem with the either the mounting options being used, which may be omitting the tracking of certain time attributes, or perhaps it's related to one of these bugs:

Community
  • 1
slm
  • 369,824
  • 1
    @JishnuUNair - can you check to see how the Samba share is being mounted (with what options)? You can typically get these from the mount command and then look for the share you're accessing. Just a guess but it's likely being mounted use gvfs as a FUSE filesystem. – slm Mar 07 '14 at 15:50
  • 2
    A lot of filesystems now support a file creation time. For ext4, you can view/change it through debugfs (although this needs root privileges and is no use here). See this question - http://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4 – Graeme Mar 07 '14 at 17:07
  • 1
    @Graeme - yes I'd just referenced a similar method using stap: http://unix.stackexchange.com/questions/91197/how-to-find-creation-date-of-file/92748#92748 in the chatroom. – slm Mar 07 '14 at 17:22
  • 2
    While Linux does not support a creation time, a Samba share can. Depending on how you set it up (and xattr support in the file system), Samba has the ability to store some time stamps in Linux xattrs. That means it may be able to do things that the underlying file system cannot - like report a valid (modifiable) creation time. Sorry, I didn't find any good links to how this works. – Peter May 30 '14 at 05:27
  • 2
    Actually most Linux file systems (eg. ext4) now support creation date, and Linux 4.11 will have a statx() call to retrieve it. Finally. – Jez Mar 10 '17 at 16:18
  • 1
    Creation date is Btime in macOS (UNIX). – Christopher Jun 23 '20 at 16:09
67

Easiest way - accessed modified will be the same:

touch -a -m -t 201512180130.09 fileName.ext

Where:

-a = accessed
-m = modified
-t  = timestamp - use [[CC]YY]MMDDhhmm[.ss] time format

If you wish to use NOW just drop the t and the timestamp

To verify they are all the same: stat fileName.ext

See: touch man

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Jadeye
  • 907
1

The easiest way you can do ...

Suppose you

change date and time

of meta data of your file.

When your teacher sees this, if she or he/she is smart, she will notice your cheating by 0x.000000000 this nano seconds.

So, What do we can do?

All you have to do is put back your date and time of your system to any date and time you want, create again your file with touch command or anything and edit it content.

enter image description here

Now send this file to him/her.

Good Luck.

Amin Seifi
  • 21
  • 2
    There is no need to change system time. Look at the touch command -r and -t options to be able to specify any timestamp you want instead of current time of day. – Patrick Mevzek May 25 '21 at 16:29
  • This was a good thing, although the Internet is a place full of different ideas. @PatrickMevzek – Amin Seifi May 25 '21 at 16:44
  • What command did you run to get the info in the first screencap? – Arthur Bowers Feb 22 '22 at 09:47
  • When this site became a source of information for cheating teachers? We better have more noble objectives to aspire in life. – DrBeco Feb 24 '22 at 02:23