hashdeep
hashdeep copied to clipboard
Timestamps
The man
page says:
-t Display a timestamp in GMT with each result. On Windows this timestamp will be the file's creation time. On all other systems it should be the file's change time.
However:
% hashdeep -t TO--DO
Try `hashdeep -h` for more information.
I'd really love to use hashdeep for forensic checking of any changes in file dates.
Would you consider including a mode which prints out the epoch seconds.nanoseconds
of all times: access, modify, change, birth?