Timeline for Tripwire report shows modification dates from when I was on vacation with computer shutdown at home
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 13, 2018 at 23:44 | comment | added | forest | @danielAzuelos I can think of several ways it can happen. Modification dates are stored in inodes, so corruption to data blocks (e.g. caused by a corrupt driver or fsck) would not necessarily change modification times. And the journal (on its own inode) could correct a certain amount of inode corruption. | |
| May 13, 2018 at 14:31 | comment | added | athena |
A FS corrupted so as to give a valid set of modification times so that tripwire would log it correctly without a ton of latteral damages is an event of very low probability. Something about the probability of a library which faced an earth quake and would look clean with just a few books replaced by brand new ones 😇.
|
|
| May 13, 2018 at 14:18 | answer | added | athena | timeline score: 0 | |
| Mar 20, 2018 at 16:19 | answer | added | user173381 | timeline score: 0 | |
| Mar 20, 2018 at 14:23 | history | tweeted | twitter.com/StackSecurity/status/976101894832746496 | ||
| Mar 20, 2018 at 4:25 | comment | added | forest | Well, either the filesystem is corrupted, or the computer was booted up between these two periods. | |
| Mar 19, 2018 at 23:11 | answer | added | LSerni | timeline score: 3 | |
| Mar 19, 2018 at 21:52 | history | edited | schroeder♦ | CC BY-SA 3.0 |
added 40 characters in body
|
| Mar 19, 2018 at 21:38 | review | First posts | |||
| Mar 19, 2018 at 21:53 | |||||
| Mar 19, 2018 at 21:38 | history | asked | user173381 | CC BY-SA 3.0 |