2

Suppose you own a file system on a unix machine, and you would like to know which of the regular files on this system you have accessed within some interval. ("Regular file" means it is not a directory.) Not modified, not changed their status, merely accessed. For instance

  • You are listening to a sequence of sound files and want to know which you have already opened today.
  • You are looking at the contents of text files using grep, less, or cat, and want to know which you have already looked into in the past 60 seconds.

On some unix systems, a command like find . -atime -60s will answer the question. This works on a macbook pro, purchased 2015, running macOS Mojave 10.14.6.

But on a macbook pro purchased March 2020, running macOS Catalina 10.15.5, this does not work. Recall that the stat command returns four distinct "times" associated with a file:

  1. accesstime or atime
  2. modification time or mtime
  3. time file status last changed or ctime
  4. birthtime

But on the new mac, atime is simply identical to ctime for a regular file. The difference can be seen below. In these examples, we also use ls to doublecheck the mtime and ctime values obtained from stat. And we see that stat behaves differently in the two releases of macOS.

macOS Mojave 10.14.6:


> ls -lT crit
-rw-r--r--  1 BNW  staff  1712 Jun 13 02:16:51 2020 crit
> ls -lTc crit
-rw-r--r--  1 BNW  staff  1712 Jun 17 18:40:25 2020 crit
> stat crit
16777220 8696326140 -rw-r--r-- 1 BNW staff 0 1712 "Jul 10 21:56:15 2020" "Jun 13 02:16:51 2020" "Jun 17 18:40:25 2020" "Jun 13 02:16:51 2020" 4096 8 0 crit
> stat -s crit
st_dev=16777220 st_ino=8696326140 st_mode=0100644 st_nlink=1 st_uid=501 st_gid=20 st_rdev=0 st_size=1712 st_atime=1594432575 st_mtime=1592029011 st_ctime=1592433625 st_birthtime=1592029011 st_blksize=4096 st_blocks=8 st_flags=0
>

Now with a new macbook pro, macOS Catalina 10.15.5, the atime value returned by stat is identical to the ctime.

> ls -lT z01
-rw-r--r--  1 kpr  staff  416397 Jun 16 12:03:11 2020 z01
> ls -lTc z01
-rw-r--r--  1 kpr  staff  416397 Jun 25 21:38:30 2020 z01
> stat z01
16777223 8163218 -rw-r--r-- 1 kpr staff 0 416397 "Jun 25 21:38:30 2020" "Jun 16 12:03:11 2020" "Jun 25 21:38:30 2020" "Jun 16 12:03:11 2020" 4096 816 0 z01
> stat -s z01
st_dev

Thus, when I use find on the new computer, it no longer returns the names of regular files recently looked at, only directories whose files have been recently accessed.

Was this a conscious choice by Apple developers? Why was this done? Under macos Catalina, is there some other way to find regular files by accesstime?

Jacob Wegelin
  • 153

0 Answers0