Well, imagine an attacker manages to break into a server, running linux. He/she uses touch to change the access time of a given file. My question is: is it possible to retrieve the old access time for a file in a ext2 filesystem or ReiserFS? This would give you an idea on when exactly the break-in happened. Ah, and sure: how would it work?