February 2nd, 2003 04:16 PM
Retrieving access time information
Well, imagine an attacker manages to break into a server, running linux. He/she uses touch to change the access time of a given file. My question is: is it possible to retrieve the old access time for a file in a ext2 filesystem or ReiserFS? This would give you an idea on when exactly the break-in happened. Ah, and sure: how would it work?
Found in a diary:
\".... and yes, since i am a l337 hax0r, i am also using vi to write this. ^[[D^[[B^ exit ^X^C quit :x :wq dang it :w:w:w :x ^C^C^Z^D\"