Editing MAC times (section)

== Change time and creation time (ctime) ==

Unix and Windows file systems interpret 'ctime' differently:

* '''Unix systems''' maintain the historical interpretation of ctime as being the time when certain file metadata, ''not its contents'', were last changed, such as the file's permissions or owner (e.g. 'This file's metadata was ''changed'' on 05/05/02 12:15pm').
* '''Windows systems''' use ctime to mean 'creation time'{{citation needed|date=January 2014}} (also called 'birth time') (e.g. 'This file was ''created'' on 05/05/02 12:15pm').

This difference in usage can lead to incorrect presentation of time metadata when a file created on a Windows system is accessed on a Unix system and vice versa.{{Citation needed|date=September 2007}} Although not specified by [[POSIX]], most modern Unix file systems (such as [[ext4]], [[HFS+]], [[ZFS]], and [[Unix File System|UFS2]]) allow to store the creation time.<ref>{{cite journal|date=April 2022 |title=A systematic approach to understanding MACB timestamps on Unix-like systems |journal=Forensic Science International: Digital Investigation |volume=40, Supplement |doi=10.1016/j.fsidi.2022.301338|last1=Thierry |first1=Aurélien |last2=Müller |first2=Tilo |page=301338 |s2cid=247735761 |doi-access=free }}</ref>
[[NTFS]] stores both the creation time and the change time.

The semantics of creation times is the source of some controversy.{{Citation needed|date=April 2019}} One view is that creation times should refer to the actual content of a file: e.g. for a digital photo the creation time would note when the photo was taken or first stored on a computer. A different approach is for creation times to stand for when the file system object itself was created, e.g. when the photo file was last restored from a backup or moved from one disk to another.