|Home » Learning Curve » ACP Guru
A look at four ACP utilities.
The ACP currently has four 'stamping' utilities: Rixmode, Rixstamp, Xstamp, and newcomer Xstat. Here's a bit about them and how they work.
Rixstamp is the original. It was written originally for Windows back in the early autumn 1995. Time stamps were used to denote version numbers and also to ferret out interlopers in critical system areas.
The OS X version is written with 'Unix' APIs and capable of modifying two of the three time stamps at the time: 'accessed' (atime) and 'modified' (mtime). The third time stamp ('created', 'stat changed', or ctime) cannot be modified by these APIs but use of the Unix APIs means the application is 'portable' to non-HFS+ volumes.
Xstamp follows on Rixstamp but is specific to Apple's HFS+ file system. HFS+ has five time stamps: create, contentMod, attributeMod, access, and backup. The HFS+ clock starts in 1904; the Unix clock starts in 1970; create is unique to earlier versions of OS X; contentMod is the same as the Unix mtime; attributeMod is the same as the Unix ctime; backup is another unique stamp; and access is the same as the Unix atime.
Versions of OS X prior to Tiger allowed modification of the contentMod field, meaning interlopers could satisfactorily hide their tracks; starting with Tiger (10.4) in April 2005 this was no longer possible.
Both Rixstamp and Xstamp can 'touch' files with the current time, use a default series of stamps for all files, and recursively stamp through directory hives.
Rixmode stamps file modes (permissions) instead. It otherwise works the same way as Rixstamp and Xstamp: browse to or drop a single file on the application and set the fields as one wants; or drop more than one or recurse to use the application defaults.
Rixmode can also use a 'mask' value (the inverse of umask) to alter rather than completely set mode fields.
Xstat is the newest in the group, released only a few days ago. Xstat is a combination of Rixmode and Xstamp and more: it stamps all modifiable fields in the stat structure: owner, group, mode, flags, and the four time stamps.
Use of the HFS+ APIs means one more of the four time stamps can be modified.
Time Stamps Today
Apple have now adopted the FreeBSD proposal for a 'birth' time stamp. This is reflected in the ACP Framework info sheet for 10.6 Snow Leopard.
Xstat currently uses the HFS+ APIs - meaning it's limited to HFS+ volumes - but it can easily retooled to use Unix instead. The difference is that HFS+ allows modification of one more field - 'create'.
The 'changed'/'attributeMod'/ctime field - since 10.4 Tiger - is not modifiable with either API but is touched anytime any of the other time stamps - or anything else in the stat structure - is changed.
Apple's OS still suffers from having parallel APIs leading to the hardware. This simply isn't good policy but Apple have their reasons for keeping things this way. There was discussion of using ZFS for Snow Leopard but that hasn't happened.