05 · Filesystem & Timestamps
ext4 and XFS Timestamps, Inodes and Deleted Files
How to read MAC and birth timestamps on ext4 and XFS, spot timestomping through ctime, and understand the real limits of deleted file recovery on Linux.
ext4xfstimestamps
How to read MAC and birth timestamps on ext4 and XFS, spot timestomping through ctime, and understand the real limits of deleted file recovery on Linux.