1

I was listing the last modified files in the root directory and found something interesting regarding some dates, so I would like to know the reason behind it. I know that you can easily modify the "last modified" date from a file, however, I would like to understand why I have found those files from the Brave Snap App with a date that I have not even turned my computer on:

...
/snap/brave/172/opt/brave.com/brave/product_logo_64.png
/snap/brave/172/usr/share/mime/x-content/video-vcd.xml
/snap/brave/172/usr/share/mime/x-content/win32-software.xml
/snap/brave/172/usr/share/mime/x-epoc/x-sisx-app.xml
...

Basically, the whole Brave App (that I don't even remember downloading btw) folder has files with a last modified date of a date that my computer was completely turned off. What could have caused this, and what would be the reason behind it?

Kusalananda
  • 320,670
  • 36
  • 633
  • 936
Lucius
  • 91
  • 2
  • the modification date is just a piece of metadata that can be changed by the file owner. In this case, `snap` applied the file dates as they were for the person packaging that brave app. This is essentially the same as happens when you unpack e.g. a `tar` archive! The unpacking program applies the original file dates, as saved in the archive. The semantics here is that files are exactly as on the application packager's computer, and hence the timestamps are like they were when he put together the brave snap. Not the time at which your computer unpacked the snap archive. – Marcus Müller Aug 08 '22 at 16:24

3 Answers3

2

The "modified date" of a file is simply informational metadata. It can be trivially changed, for example:

touch item
ls -l item
-rw-r--r-- 1 roaima roaima 0 Aug  8 17:27 item

touch -t 2012040445 item    # 2020 Dec 4, 04:45
ls -l item
-rw-r--r-- 1 roaima roaima 0 Dec  4  2020 item

touch -t 2303011933 item    # 2023 Mar 1, 19:33
-rw-r--r-- 1 roaima roaima 0 Mar  1  2023 item

Note though, that whenever you change the mtime metadata, the ctime (inode change time) is updated, so it's not possible to hide a deliberate change from close inspection (2022-08-08 17:29:35 corresponds exactly to the last touch command):

stat item
  File: item
  Size: 0               Blocks: 0          IO Block: 4096   regular empty file
Device: 801h/2049d      Inode: 4980781     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/  roaima)   Gid: ( 1000/  roaima)
Access: 2023-03-01 19:33:00.000000000 +0000
Modify: 2023-03-01 19:33:00.000000000 +0000
Change: 2022-08-08 17:29:35.080989340 +0100
 Birth: -

In your case, the mtime metadata is stored in the snap archive and restored along with the file name and contents.

See man touch and man stat for further details, along with How can I change 'change' date of file?

roaima
  • 107,089
  • 14
  • 139
  • 261
0

As you already describe, the modification date is just a piece of metadata that can be changed by the file owner.

In this case, snap applied the file dates as they were for the person packaging that brave app. This is essentially the same as happens when you unpack e.g. a tar archive!

The unpacking program applies the original file dates, as saved in the archive. The semantics here is that files are exactly as on the application packager's computer, and hence the timestamps are like they were when he put together the brave snap. Not the time at which your computer unpacked the snap archive.

Marcus Müller
  • 21,602
  • 2
  • 39
  • 54
  • This has caught a large number of people in the past on systems where `/tmp` is cleaned out regularly on the basis of last-modified timestamps. The user will untar an archive into `/tmp`, all timestamps are way in the past, and the entire archive is deleted by the system. The users are annoyed that their files disappeared and the sysadmins are blamed for deleting the archive. Nobody wins. – doneal24 Aug 08 '22 at 20:06
  • "_The user will untar an archive into `/tmp`_" @doneal24 particularly on RAM-backed filesystems that's an issue straight off – roaima Aug 08 '22 at 20:44
-1

Why did the dates of the Brave App files show a time your computer wasn't powered on?

Most likely because you didn't download the individual files. Instead you downloaded a software package or a single archive file containing them. When you ran the command to install the package (or unpack the archive), the command read the original timestamps of the individual files and set them. This is common when working with files that have been packaged or archived together.

Sotto Voce
  • 3,664
  • 1
  • 8
  • 21
  • even when downloading files e.g. using `wget`, the downloading program can (and does) set the modification date to the date the webserver says the file was modified – Marcus Müller Aug 08 '22 at 19:45