When you choose Age Coloring in the contextual menu, the icons are colored according to how old the file is. The color key here shows how.
X11 | MacOS | |
Age/Permissions coloring toggle | altG | ^G |
open color key | altI | ^I |
The color is taken from the rainbow: Yellow
files are "hot" and recently changed, Blue
files are "cold" and pretty stable, and different colors of the
rainbow in between represent whatever age in between.
For directories, the times depicted are actually the most recent times found in the directory and all of its subdirectories - not just the directory's time itself. This way, you can see if ANYTHING changed inside, no matter how deep.
During tallying of a large directory, there is a tendency for the directory colors
to get more yellow as time goes on, because as the tallying proceeds deeper, there
are more opportunities for more recent files to be discovered.
The most obvious color is the inside color for the icon, which shows you the modify (write) time.
The outside of the icon has its own color. This is the access (read) time. Often, this facility is disabled on certain volumes for performance and/or security reasons. If so, the outside color might be dark blue (reflecting a time long ago when the access times were last set), or it might match the Modify time. Even if the access time is available, Interrogator and other programs such as ls and find regularly scan through directories, setting the access time. When Interrogator decides that the access time is not useful, it simply colors the outside gray.
The file name itself has yet a third color - the Header time, sometimes called
the Change time (sometimes confused with the Create time), sometimes called the Attribute
Modify time. The Header time is updated when attributes about the file are changed.
This time is useful for forensic analysis - it is harder to falsify, because the
utime(2) system call can set the access and modify times, but not the header time.
(The shell command to falsify the dates on a file is touch;
commands are also available in perl and other scripting languages.
All of these, however, go through the utime(2) system call bottleneck.)
Indeed, for the animation above, you can see that the header time of jtear is always
recent; we had to artificially set the file times for the sake of the demonstration.)
Documentation >
Directory Window >
Age Coloring