On Sat, 2004-01-31 at 03:37, Robert Brockway wrote:
> On Fri, 30 Jan 2004, Christoph Hellwig wrote:
>
> > There's no data-integrity issues, but there's certain applications that rely
> > on atime information.
>
> The question is which apps.
>
> I usually mount filesystems noatime but the caveat has always been,
> "watchout some apps require it". I think this has reached the point of
> being unix folk-lore.
>
> I've asked many Sysadmins to name a single app that misbehaves if
> filesystems are mounted noatime and (as far as I recall) no one has yet
> presented a credible example. This isn't criticism of the claim, just a
> genuine request.
>
> Can anyone name an application which misbehaves or breaks if filesystems
> it relies on are mounted noatime?
>
> This is somewhat OT I know, but while we're talking about it...
>
> Rob
Part of my company does computer forensics. As part of that our
forensics team might testify in court that
"Rob created a flat file export of the Customer Database on Dec 15, 03.
He accessed this flat file at 2pm, Feb 2, 04. This is 2 hours after he
was notified that he was being fired, so it is possible that he was
making an improper copy to use outside the company."
Obviously the above is not rock-solid evidence of IP theft, but it is
far stronger than if the access time was not available.
I know our forensic team wishes that all computers would maintain a much
better history of access times than just the most recent.
I guess what I'm saying is, if you are maintaining valuable info on a
computer and the possibility of having to litigate about its use exists,
then having access times available to a computer forensic examiner is a
good idea.
Greg
--
Greg Freemyer
|