Linux – How to the modification date of a file be in the future

linuxtimestamp

Whenever I change a file on my (Scientific Linux 6, 64bit) machine, its modification date is set in the future:

bash$ touch new.txt && stat -c %y new.txt && date
2016-09-19 12:33:08.763882267 +0200
Mo 19. Sep 12:30:21 CEST 2016

How can this possibly happen and how can I make the modification dates sane again? It seems as if the difference between the actual time and the modification time is increasing the longer the machine is active.

Best Answer

As confirmed in comments above, you are working with a networked filesystem where the server and client times are not synced. The file is created with a timestamp provided by the server and so it is 3 minutes in the future from the perspective of your workstation. This is easily avoidable if you're running NTP or some other time synchronization system.

Related Solutions

Linux – Using find -mmin to find files with modification time in the future

To find files modified at least 5 days in the future, use:

find . -newermt "5 days"

The syntax for the time specification corresponds to the one for date -d. See man find for info on the switch named -newerXY for more information.

It is not possible to use e.g. -mmin to do this. It was reported as a bug against GNU find, and was solved by implementing -newerXY in findutils 4.3.3 (~2007) as I showed above.

Apparently it was not GNU find that was used, but BusyBox.

You should then be able to create a temporary file with touch -d and a date in the future and then use the -newer switch for find such as:

touch -d "+5 days" tmpfile
find . -newer tmpfile

BusyBox touch does not support that date format, but the principle is the same and its find supports -newer. Creating the reference file with a correct date is left as an exercise for the reader (always convenient to write).

The accuracy of file creation or modification dates

File metadata (e.g. creation date, last modified, etc) is generally a matter of the file system, and can thus be modified using various software tools. In fact, some filesystems don't even track creation date (e.g. ext3 on linux tracks ctime, which is actually an inode change time). The metadata that is tracked will also vary from filesystem to filesystem - some filesystems will allow tracking of last access time, last modified, etc.

The ease of changing this "creation time" (or last modified, last accessed, etc) may vary from file system to file system, but in general, these timestamps are not 100% reliable.

I would imagine in a courtroom environment, one party would try to suggest the last modified times are good due to the user being of a certain ability, other file times matching, etc, while the opposing party would try an point out that file times can be faked. It's unclear to me which side would succeed in convincing a judge or jury as to what likely happened, unless a "smoking gun" of sorts is found that shows inconsistencies with the timestamps (e.g. two files created on the same date have wildly varying dates, or copies of the file were emailed before the supposed creation date, etc).

I'm not aware of any hardware methodologies to track modifications.

Best Answer

Related Solutions

Linux – Using find -mmin to find files with modification time in the future

The accuracy of file creation or modification dates

Related Question