±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 4 Overall: 36595
New Yesterday: 5 Visitors: 139

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Preserve Timestamps when using TAR oder RSYNC

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Preserve Timestamps when using TAR oder RSYNC

Post Posted: Feb 13, 20 06:40


it seemed to me that this would be a very easy topic - I thought so...

The thing is, we got problems imaging the newer Macbooks (t2-chip, etc.), so to get at least a "logical file dump" I thought about using rsync to a hfsplus usbdrive, or using tar.

To test this workflow I played with tar on my linux workstation.

Thinking of linux/unix timestamps, there are 3 timestamps: atime, mtime, ctime.

Now I tried both, rsync and tar with its parameters for preserving the maximum of metadata. I tend more towards tar, so I tried:

tar --atime-preserve -cfz archive.tar.gz /myfoldertoarchive

But after extracting the archive via

tar -xpf archive.tar.gz

atime and ctime get the timestamp of extraction time.

Then I realized, that --atime-preserve is for the extracting part, so I tried also

tar --atime-preserve -xpf archive.tar.gz

That didnt work either.

Does anyone have an advice why --atime-preserve does not work for me, and how I could perhaps even preserv ALL 3 timestamps, so also the "ctime" one?

Thank you, also for this forum and the great collaboration.


Page 1 of 1