Re: [tlug] Using TCT...help

[B0Ti <9915104t@example.com>]

Operator wrote:

> Run mactime to create an initial database of the time stamps associated with
> your system files. (done) Re-boot your machine (done) Run mactime again and
> determine which files have been modified by booting the machine. Which files
> were accessed but not modified? (Requires root access.)
>
> My problem (question) is how do I determine which files have been modified??

You have answered your own question.
man mactime:
"mactime - an mtime, atime, and ctime reporter"

See `man stat` for more details about atime, mtime and ctime:
                  time_t        st_atime;    /* time of last access */
                  time_t        st_mtime;    /* time of last modification */
                  time_t        st_ctime;    /* time of last change */


> I'm not sure but I THINK the diff command is used here... again.. not sure..

diff is for:
"diff - find differences between two files"


--
B0Ti.