Glossary: Logs and Data Sources for Investigations

File timestamps

Also written: Birth, Modify, Change, Access, MAC times

The four times Linux keeps for each file: Birth (created), Modify (content last changed), Change (metadata last changed) and Access (last read). Investigators can update the access time just by looking, as Alex's own scan did on /tmp/.sync.