Is it possible to trace a file's history?
up vote
1
down vote
favorite
A file recently appeared on my desktop, an image of a chess board.
I'd like to know a bit more about it. Unfortunately, thinking it was a gift from someone I knew, I have opened it in Gimp, modified it, and saved it. So I can't even see what day the file was created (since ls -al only shows me date modified, not date created).
Is there some utility for learning more about a file in Ubuntu (the OS I am using)?
ubuntu file-management
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
add a comment |
up vote
1
down vote
favorite
A file recently appeared on my desktop, an image of a chess board.
I'd like to know a bit more about it. Unfortunately, thinking it was a gift from someone I knew, I have opened it in Gimp, modified it, and saved it. So I can't even see what day the file was created (since ls -al only shows me date modified, not date created).
Is there some utility for learning more about a file in Ubuntu (the OS I am using)?
ubuntu file-management
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
1
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
A file recently appeared on my desktop, an image of a chess board.
I'd like to know a bit more about it. Unfortunately, thinking it was a gift from someone I knew, I have opened it in Gimp, modified it, and saved it. So I can't even see what day the file was created (since ls -al only shows me date modified, not date created).
Is there some utility for learning more about a file in Ubuntu (the OS I am using)?
ubuntu file-management
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
A file recently appeared on my desktop, an image of a chess board.
I'd like to know a bit more about it. Unfortunately, thinking it was a gift from someone I knew, I have opened it in Gimp, modified it, and saved it. So I can't even see what day the file was created (since ls -al only shows me date modified, not date created).
Is there some utility for learning more about a file in Ubuntu (the OS I am using)?
ubuntu file-management
ubuntu file-management
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
edited Aug 5 '12 at 16:16
Der Hochstapler
67k48230283
67k48230283
asked Jul 25 '12 at 3:39
Ziggy
4361717
asked Jul 25 '12 at 3:39
Ziggy
4361717
asked Jul 25 '12 at 3:39
Ziggy
4361717
4361717
1
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29
add a comment |
1
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29
1
1
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
To answer your sub-question: To see the date the file was created, add -U (OS X and other BSDs) or -c (Linux) to your ls options.
See also stat(1).
If you were on a Mac and use Time Machine, or if you were using an app that makes use of autosave in OS X 10.7 Lion and later, use Time Machine to check for previous revisions of the file, and then check their metadata using a tool that understands the metadata of that file format.
Depending on what OS you're on, there may be other pieces of metadata (extended attributes, etc.) for the file embedded in the filesystem's entry for that file, not in the file itself. So the answer would vary by OS.
It's always good to specify which OS(es) and OS versions you're talking about when asking questions here. Gimp runs lots of places including OS X and Windows, so we can't assume you meant a certain flavor of Linux just because you said you used Gimp.
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.-clists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.
– Spiff
Jul 27 '12 at 2:00
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
To answer your sub-question: To see the date the file was created, add -U (OS X and other BSDs) or -c (Linux) to your ls options.
See also stat(1).
If you were on a Mac and use Time Machine, or if you were using an app that makes use of autosave in OS X 10.7 Lion and later, use Time Machine to check for previous revisions of the file, and then check their metadata using a tool that understands the metadata of that file format.
Depending on what OS you're on, there may be other pieces of metadata (extended attributes, etc.) for the file embedded in the filesystem's entry for that file, not in the file itself. So the answer would vary by OS.
It's always good to specify which OS(es) and OS versions you're talking about when asking questions here. Gimp runs lots of places including OS X and Windows, so we can't assume you meant a certain flavor of Linux just because you said you used Gimp.
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.-clists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.
– Spiff
Jul 27 '12 at 2:00
add a comment |
up vote
0
down vote
To answer your sub-question: To see the date the file was created, add -U (OS X and other BSDs) or -c (Linux) to your ls options.
See also stat(1).
If you were on a Mac and use Time Machine, or if you were using an app that makes use of autosave in OS X 10.7 Lion and later, use Time Machine to check for previous revisions of the file, and then check their metadata using a tool that understands the metadata of that file format.
Depending on what OS you're on, there may be other pieces of metadata (extended attributes, etc.) for the file embedded in the filesystem's entry for that file, not in the file itself. So the answer would vary by OS.
It's always good to specify which OS(es) and OS versions you're talking about when asking questions here. Gimp runs lots of places including OS X and Windows, so we can't assume you meant a certain flavor of Linux just because you said you used Gimp.
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.-clists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.
– Spiff
Jul 27 '12 at 2:00
add a comment |
up vote
0
down vote
up vote
0
down vote
To answer your sub-question: To see the date the file was created, add -U (OS X and other BSDs) or -c (Linux) to your ls options.
See also stat(1).
If you were on a Mac and use Time Machine, or if you were using an app that makes use of autosave in OS X 10.7 Lion and later, use Time Machine to check for previous revisions of the file, and then check their metadata using a tool that understands the metadata of that file format.
Depending on what OS you're on, there may be other pieces of metadata (extended attributes, etc.) for the file embedded in the filesystem's entry for that file, not in the file itself. So the answer would vary by OS.
It's always good to specify which OS(es) and OS versions you're talking about when asking questions here. Gimp runs lots of places including OS X and Windows, so we can't assume you meant a certain flavor of Linux just because you said you used Gimp.
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
To answer your sub-question: To see the date the file was created, add -U (OS X and other BSDs) or -c (Linux) to your ls options.
See also stat(1).
If you were on a Mac and use Time Machine, or if you were using an app that makes use of autosave in OS X 10.7 Lion and later, use Time Machine to check for previous revisions of the file, and then check their metadata using a tool that understands the metadata of that file format.
Depending on what OS you're on, there may be other pieces of metadata (extended attributes, etc.) for the file embedded in the filesystem's entry for that file, not in the file itself. So the answer would vary by OS.
It's always good to specify which OS(es) and OS versions you're talking about when asking questions here. Gimp runs lots of places including OS X and Windows, so we can't assume you meant a certain flavor of Linux just because you said you used Gimp.
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
answered Jul 26 '12 at 9:28
Spiff
76.1k10116158
76.1k10116158
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.-clists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.
– Spiff
Jul 27 '12 at 2:00
add a comment |
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.-clists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.
– Spiff
Jul 27 '12 at 2:00
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Thanks for the note there: I am on linux. It appears that the -c option for ls just displays the last modified time?
– Ziggy
Jul 26 '12 at 16:34
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
Even the created timestamp may be changed depending on how the program the OP edited it with behaves. It may copy the created timestamp of the original file to the modified file, or it may just leave it with the current time.
– Synetech
Jul 26 '12 at 16:43
@Ziggy Oops, I didn't read the Linux man page carefully enough.
-c lists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.– Spiff
Jul 27 '12 at 2:00
@Ziggy Oops, I didn't read the Linux man page carefully enough.
-c lists/sorts by the ctime, which is the last time the inode was changed, not its creation time. Filesystems in use with OS X and other BSDs have a real file creation time (birth time). I don't know the details of this on Linux.– Spiff
Jul 27 '12 at 2:00
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f453249%2fis-it-possible-to-trace-a-files-history%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
You could try opening it in a hex-editor to see if there is any metadata that gives clues as to its origin, but the program you used to edit it may or may not have retained the original metadata.
– Synetech
Jul 25 '12 at 4:18
Mystery solved with regards to the file itself: turns out it is exactly what I thought it was! Question still stands.
– Ziggy
Jul 26 '12 at 4:54
Well how did you figure it out? Next time, just use whatever technique you used this time.
– Synetech
Jul 26 '12 at 4:57
Ha ha, yes: it was an HR problem that I solved in the HR domain. I'd like a more general solution for the future. Good suggestion though!
– Ziggy
Jul 26 '12 at 16:29