1

I have three questions related to the "ctime" information of a file. They are in bold (if you don't have time you can jump directly to them).


A website on my dedicated server has been hacked. Lots of files have been edited. I noticed that some hackers were clever enough to reset the mtime (some not).

atime and mtime can be changed with PHP functions. ctime can also be changed by using the chmod function. But ctime is handled by the kernel, so it's only possible to set it to the current system date/time. It's impossible to set it back to the past.

I found some backdoors whose mtime had been reset to the ctime (date in the past, like 1 or 2 years ago), so that I can't find it using recursive search tool based on that information.

The key to be able do find quickly all infested files is of course the ctime information. The problem is that I didn't think of it at first, so I first "chmoded" recursively all the files so that the website itself doesn't have write permissions anymore. In doing this, I lost the precious ctime information.

I have lots of backups, in form of .tar.gz files. I want to know if there is a way to extract from the tar.gz file the ctime of the files of the moment they were added the the tar.

I read the whole GNU tar documentation, and found out that the "GNU" format of tar (which is the default used by my Linux server) stores the ctime of its archived files. I tried following way to extract it:

tar -zxf Friday.tar.gz --to-command=./script

./script is a bash script and looks like this:

#!/bin/bash
echo $TAR_CTIME

The problem is that this gives the current date and time, maybe because tar gives out the informations of the file it would itself create if I hadn't used --to-command


If tar cannot handle this, is there backup tools which can keep original ctime information?


How to list every file whose mtime and ctime differ? I read the find manual but only found out the -newerXY, which (if I understand well), can only compare a ctime with a ctime, a mtime with a mtime, etc. Is there a way to compare a ctime and a mtime of the same file?

4
  • atime-preserve is a long option, but I don't see any mention of ctime.
    – user160910
    Jul 2, 2013 at 20:18
  • 1
    Short note: you cannot set ctimes. I wrote an article detailing such things.
    – Halfgaar
    Jul 2, 2013 at 20:18
  • Yes, I already read your article before posting here. :) There is a way to set ctime: if you are the owner of the file, you can just chmod it. This resets the ctime to the current system date.
    – Fox
    Jul 2, 2013 at 20:22
  • To catch this sort of activity, where an attacker alters file modification times, audit the utime() system call. Of course, you must have set this up before the compromise. Jul 2, 2013 at 20:22

3 Answers 3

1

Have you considered using tar compare option to see which files are changed? This should give you a quick list of candidates.

2
  • I haven't thought about it! But is it possible to specify a subpath of the tar archive to compare? Like tar -dvf archive.tar folder/inside/tar/to/be/compared/to/filesystem
    – Fox
    Jul 4, 2013 at 18:54
  • I believe so. Read the man page.
    – BillThor
    Jul 4, 2013 at 23:08
0

ctime is controlled by kernel, not any userspace tool, tar or any other program, because to back up and restore, they have to create a new inode which must have a new ctime. one known way to preserve it is to image your filesystem to a loopback file, and save that image. unless your filesystem is quite full and you do want to save the whole thing, it is quite wasteful.

there are more efficient programs such as partimage, but i have not checked if they preserve ctime of inodes.

2
  • I know that the creation of a new file makes a new ctime by the kernel. But since tar stores the original ctime information, would it be possible to "read in his internal data" just to get the information, without creating any file (like in the "-t" option)?
    – Fox
    Jul 2, 2013 at 20:38
  • tar does not preserve the inode so you cannot. ctime is part of the inode, which is a filesystem data structure. that is why you have to backup the entire filesystem to preserve it. i guess it is possible for a backup software to preserve it by saving the inode information, but since it cannot be used in restoring the file it is not useful and thus likely not implemented anywhere.
    – johnshen64
    Jul 2, 2013 at 20:53
0

star with exustar format (tar with POSIX.1-2001 extended headers) stores all 3 timestamps:

$ stat 3times
  File: '3times'
  Size: 7               Blocks: 8          IO Block: 4096   regular file
Device: 13h/19d Inode: 20209028    Links: 1
Access: (0400/-r--------)  Uid: ( 1000/   gotar)   Gid: ( 1000/   users)
Access: 2021-07-15 12:31:53.085946972 +0200
Modify: 2021-07-15 12:32:10.049040551 +0200
Change: 2021-07-15 12:32:16.435616907 +0200
 Birth: -

$ star artype=exustar 3times -c > 3times.star
star: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).

$ grep -a time= 3times.star | strings
[...]
30 atime=1626345113.085946972
30 ctime=1626345136.435616907
30 mtime=1626345130.049040551
[...]

$ perl -E 'say scalar localtime 1626345113; say scalar localtime 1626345136; say scalar localtime 1626345130'
Thu Jul 15 12:31:53 2021
Thu Jul 15 12:32:16 2021
Thu Jul 15 12:32:10 2021

and under certain conditions they can be restored. Or more or less roughly extracted (like above).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.