Linux Time Stamps

[Forensik]

OSF shows 3 times stamps related to files and directories:

• Created
• Modified
• Accessed

How do they correspond with Linux Time stamps like ctime, mtime and atime?

See also http://www.linux-faqs.info/general/difference-between-mtime-ctime-and-atime

Thanks in advance

[keith]

Created corresponds to ctime, but it seems to be misleading as ctime is not the file creation time but the inode change time. We will fix this for the next build.

mtime and atime are correctly displayed as Modified and Accessed respectively.