Can modified dates be modified?

August 4, 2011 8:31 PM

Is it possible to modify a file and either (a) retain the previous modified date, or (b) reset the modified date to the previous modified date - i.e. make a change to a file in such a way that the change couldn't be detected by date modified?

I have a vendor who supplies batches of image files. When any of the files are changed, I receive a full re-delivery of the batch. I only want to update the changed files at my end, so sorting the files by date modified seems a logical approach.

However, if perhaps they were unscrupulous and wanted to update some other files that maybe had errors and they didn't want anyone to know, could they update those too, somehow retaining the previous modified date, so that nobody would know?

Obviously if this is possible and they're making changes on the fly, my technique of sorting by date modified is not an effective strategy.

posted by forallmankind to computers & internet (15 answers total)

It is possible to set any of the dates on a file to whatever you want.
posted by aubilenon at 8:35 PM on August 4, 2011

Yes, they can do this by right-clicking on the file and selecting Properties.
http://windows.microsoft.com/en-US/windows7/Change-the-properties-for-a-file
posted by Deflagro at 8:39 PM on August 4, 2011

Hmm - can't do the Windows 7 change in XP. I'll have to try Win7 @ work tomorrow.
posted by forallmankind at 8:45 PM on August 4, 2011

Does this one work for you?
posted by Deflagro at 8:58 PM on August 4, 2011

You're wondering if they can modify them and leave you unable to tell because they manipulate the date?

Absolutely they can.

A better, but still simple approach to detect changes is to checksum the old version and the new and then compare the two.
posted by tyllwin at 9:07 PM on August 4, 2011

Deflagro - looks like your 2nd example requires an install of Febooti (?) software, but looks pretty convincing nonetheless.

tyllwin - how would I do that? Wikipedia says I can use Bitser, but it wants to download MS .NET Framework 4 Client profile which seems huge.
posted by forallmankind at 9:17 PM on August 4, 2011

I work in digital forensics, and I must reinforce everything that tyllwin said: manipulating any attribute of a file is easy. Checksums are your friend, and you should absolutely use them in this situation.
posted by fearnothing at 10:41 PM on August 4, 2011

Sorry didn't realize that was for a program. Here's a freeware program that also does it.

So basically to answer your question, yes, it can be done!
posted by Deflagro at 10:48 PM on August 4, 2011

You want something like ExactFile or md5summer. The basic idea is that you select your files and make a list of their checksums (and save it somewhere). Then later you can re-check the files against the saved checksums (any files that have been changed will be noted).
posted by zengargoyle at 11:00 PM on August 4, 2011

This is trivial to do in any programming language. If they are using a unix-like filesystem touch has been around forever and can change any of the time attributes. There's a windows toolkit version around as well.
posted by benzenedream at 2:57 AM on August 5, 2011

Here's a Python script, stolen shamelessly from StackOverflow:

>>> import hashlib
>>> def hashfile(f, hasher, blocksize=65536):
... buf = f.read(blocksize)
... while len(buf) > 0:
... hasher.update(buf)
... buf = f.read(blocksize)
... return hasher.digest()

>>> hashfile(open("foo.py"), hashlib.sha1())
... '\xb8\x8f\x1e\xc0\xc9\xfe\x96\xfd\xe9jo\x9d\xab\xcb\xee\xe6a\xddz\xfe'


You can call hashfile on any of your files and it will return a unique string; if the file changes, so does the string.

If you don't know Python I can write you a quick and dirty script that will do this to all the files in a directory and return the ones changed since the last one. You could also ask a question on StackOverflow and the many nice people there will help.
posted by katrielalex at 3:52 AM on August 5, 2011

_{Mefi indent fail. The lines starting with buf, while, and return should be indented four spaces, and those starting with hasher and the second buf should be indented eight.}
posted by katrielalex at 3:53 AM on August 5, 2011 [1 favorite]

katrielalex - I hope you don't mind me smiling a bit over the fact that cutting-and-pasting a Python snippet ran into indent problems.

For the future, I think you just have to use <pre> tags to maintain indentation.
posted by benito.strauss at 8:37 AM on August 5, 2011

Can't you just change your computer clock when you save the file? I seem to recall that working for me at one point. (Nothing unethical, exactly, just didn't really want my prof knowing that I started a major project were about three days before the due date. ;))
posted by purplecrackers at 9:40 AM on August 5, 2011

ExactFile can create a digest of all the files in my old delivery and then compare them with the new: Exact-ly what I need - thanks!
posted by forallmankind at 10:00 PM on August 5, 2011