Editing MAC times (section)

{{Disputed|date=June 2012}}
'''MAC times''' are pieces of [[file system]] [[metadata]] which record when certain events pertaining to a [[computer file]] occurred most recently. The events are usually described as "modification" (the data in the file was modified), "access" (some part of the file was read), and "metadata change" (the file's permissions or ownership were modified), although the acronym is derived from the "mtime", "atime", and "ctime" structures maintained by [[Unix]] file systems. Windows file systems do not update ctime when a file's metadata is changed{{citation needed|date=January 2014}}, instead using the field to record the time when a file was first created, known as "creation time" or "birth time". Some other systems also record birth times for files, but there is no standard name for this metadata; [[ZFS]], for example, stores birth time in a field called "crtime". MAC times are commonly used in [[computer forensics]].<ref>{{cite book |last=Luque |first=Mark E. |chapter=Logical Level Analyses of Linux Systems |pages=182–183 |editor-last=Casey |editor-first=E. |title=Handbook of Computer Crime Investigation: Forensic Tools and Technology |location=London |publisher=Academic Press |year=2002 |isbn=0-12-163103-6 }}</ref><ref>{{cite book |last=Sheldon |chapter=Forensic Analyses of Windows Systems |pages=134–135 |editor-last=Casey |editor-first=E. |title=Handbook of Computer Crime Investigation: Forensic Tools and Technology |location=London |publisher=Academic Press |year=2002 |isbn=0-12-163103-6 }}</ref> The name Mactime was originally coined by Dan Farmer, who wrote a tool with the same name.<ref>{{cite web |url=http://drdobbs.com/cpp/184404275 |title=What Are MACtimes? |author=Dan Farmer |author-link=Dan Farmer |publisher=[[Dr Dobb's Journal]] |date=October 1, 2000 }}</ref>