Love these EA scripting posts!
So, I never did this in my environment, but, if I had, even though about 30% of my users had full admin privileges the vast majority of them would have never messed with changing date / time stamps on files. In light of this it seems to me that a pretty good indication of when a computer was imaged would be when the top level directory
/was created.
All files on the OS X file system (or any UNIX) have an inode number, therefore, all files have a built in chronology of creation independent of date / time. Here's a command you could run to get this information:
/usr/bin/find / -maxdepth 1 -inum 2 -exec stat -f %B {} ;That's using find to search the top level directory for a file with an inode number of 2 (which just so happens to be the inode number of)
/without searching into any directories below that, then, using the stat command to show the inode birth date in seconds (or epoch time.) On my computer the result is:
But we can do better...
#!/bin/bash
# determine the inode birth date for / then convert seconds to "WeekdayName MonthName DD YYYY" format
eval $(/usr/bin/stat -s /)
result=$(/bin/date -j -f "%s" "$st_birthtime" "+%a %b %d %Y")
echo "<result>$result</result>"
# /usr/bin/find / -maxdepth 1 -inum 2 -exec stat -f %B {} ;
# result=$(/bin/date -j -f "%s" "$st_birthtime" "+%Y%m%d")This uses eval with a handy feature of stat: shell output. It sets the values stat outputs as shell variables so they can be used in a script! I wish more binaries had this feature. The value we need is $st_birthtime, i.e., the inode birth date. I'm also using the date command to convert the seconds into a human-readable date.
You could replace that line with the line I have commented at the bottom if you wanted a YYYYMMDD format instead. You may proceed with telling me why this is a bad idea but it still has some fun stuff in it. Enjoy!
That actually makes sense to me: the OS is copied into the top level directory. :)
So, any suggestions out there? What would be the definitive directory to check inode birth date? Here are 2 other very low inode numbers.
1 last thing @donmontalvo -
If you run this instead does it match your last imaged date? Thanks!
#!/bin/bash
# determine the inode birth date for /System/ then convert seconds to "WeekdayName MonthName DD YYYY" format
eval $(/usr/bin/stat -s /System/)
result=$(/bin/date -j -f "%s" "$st_birthtime" "+%a %b %d %Y")
echo "<result>$result</result>"
