mac_apt icon indicating copy to clipboard operation
mac_apt copied to clipboard

Published 20 hours ago • verified publisher icon ydkhatri

Get file created (birth) time on linux

Open ydkhatri opened this issue 6 years ago • 2 comments

Currently modified time is passed as created/birth time because of python's limitation (dependency on stat). This issue only affects running mac_apt in MOUNTED mode when the platform is linux.

The pyaff project has this implemented here: https://github.com/aff4/pyaff4/pull/6/files We can use the same too!

ydkhatri avatar Nov 11 '19 16:11 ydkhatri

Even with this functionality, it will not work with apfs-fuse as FUSE (for linux) does not appear to have any support for populating birth time (crtime). FUSE has not been updated to use the newer statx() sys call structures !

ydkhatri avatar Dec 26 '19 01:12 ydkhatri

With the last update 7f8f4f, this is implemented, but won't be useful till FUSE implements statx!

ydkhatri avatar Jan 02 '20 02:01 ydkhatri