2012-10-23 02:38:42 – boot.
2012-10-23 02:40 – apparent modification date and time of a .vdi (virtual disk image), that is:
- long after the suspected kernel panic
- long before the subsequent run of the VirtualBoxVM for the modified file.
Screenshots etc. at http://www.wuala.com/grahamperrin/publi ... de=gallery
For the pool where the .vdi is stored:
- Code: Select all
2012-10-23.02:39:34 [internal pool import txg:2218492] pool spa 28; zfs spa 28; zpl 5; uts ZFS_ON_DARWIN 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 MacBookPro5,2
2012-10-23.02:40:19 [internal snapshot txg:2218511] dataset = 3596
2012-10-23.02:41:26 [internal destroy txg:2218522] dataset = 3596
2012-10-23.02:41:53 [internal snapshot txg:2218527] dataset = 3710
2012-10-23.02:42:14 [internal destroy txg:2218531] dataset = 3710
Question
Is it desirable for the modification date and time of a file to be set in this way following an incident such as a kernel panic?