(0012221)
|
NickH
|
2019-07-11 04:32
|
|
If using "find", use ctime and not mtime. Look at this:
[root@server quarantine]# stat *
File: ‘ExcelLR.cab.190711_100316’
Size: 16882259 Blocks: 32976 IO Block: 4096 regular file
Device: 802h/2050d Inode: 101514855 Links: 1
Access: (0770/-rwxrwx---) Uid: ( 1001/ nick) Gid: (60005/ howitts)
Access: 2019-07-11 10:08:27.611502665 +0100
Modify: 2010-03-31 03:31:36.000000000 +0100
Change: 2019-07-11 11:03:17.040047009 +0100
Birth: -
The file was created by Micro$oft on 2010-03-31(mtime). It was moved into quarantine on 2019-07-11 at 11:03:17 (ctime), and last accessed on 2019-07-11 at 10:08:27 (when it was in its previous un-quarantined location by the scanner) (atime).
atime is not safe to use as some users add the noatime paramater in /etc/fstab to reduce disk writes. |
|