Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

File Last Modified

Is it safe to use File Last Modified (e.g. NTFS) when detecting if a file has changed? If not, does file backup applications always hash the whole file to check for changes? If so what hash algorithm is suited for this check?

like image 282
Stig Avatar asked Dec 10 '11 22:12

Stig


1 Answers

It depends on the requirements of the application. Can it tolerate false positives? False negatives?

A File Last Modified date is not reliable. For example, FTP may change the modified date without changing the file, or a file could be downloaded twice, once over itself, changing the modified date without changing the file. On the other hand, there are a few utilities that will change a file but keep the same File Last Modified date.

If action absolutely must be taken on a file when it has been changed, the reliable way is to use a good hash or fingerprint. This does take time. One way to improve the odds without taking so much time would be to compare the modified date along with the file size, but again this is not foolproof.

like image 132
xpda Avatar answered Dec 10 '22 07:12

xpda