3

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently?

The filesystem is mounted as so:

UUID=XXXX /home           ext4    defaults        0       2

I'm interested in a distro-neutral solution, however barring that I am currently using Ubuntu Server 12.04.

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
dotancohen
  • 15,494
  • 26
  • 80
  • 116
  • 3
    I wouldn't count on it, but you never know. What filesystem & mount options do you have? – Mat Aug 20 '14 at 08:20
  • Doing a `cat file` will not change the `atime` at all. You can check it using `stat file` If you used `view file` or `vi file` that would alter `Access, Modify and Change` attributes – Valentin Bajrami Aug 20 '14 at 09:23
  • @val0x00ff: I added the fstab options to the question. – dotancohen Aug 20 '14 at 09:37
  • @dotancohen The access time cannot be recovered. The system doesn't keep track of file access times. This is for a reason since auditing otherwise would be impossible – Valentin Bajrami Aug 20 '14 at 09:45
  • @val0x00ff: Thanks, val. I figured that was the answer, but I had to hear it from someone with more experience than me. I'll leave the question open if some neckbeard guru ever comes across it with an answer out of Mordor. – dotancohen Aug 20 '14 at 10:28
  • @val0x00ff Unix filesystems do keep track of file access times (though this is disabled by default on modern Linux systems for performance reasons). What they hardly ever do is keep **logs** of access times, so that when the atime is updated, old values are not recorded anywhere. This is because the logs would be huge, not for any reason related to auditing (on the contrary, systems with pressing auditing requirements would log all atimes). – Gilles 'SO- stop being evil' Aug 20 '14 at 20:40

1 Answers1

1

This is not possible. There is no history of previous atime values kept in memory by the system.

Well, to be completely honest, the previous atime value may exist somewhere on RAM or even on disk, but you wouldn't know where, nor for how long.

Totor
  • 19,302
  • 17
  • 75
  • 102