On UN*X, st_ctime is the last status change time, not the creation time.

That's the time the file's inode last changed, so size changes,
permission changes, etc. affect it.  It's *not* the time the file was
created; most UN*Xes don't provide that.  Newer versions of FreeBSD,
NetBSD, OpenBSD, and macOS do, but other UN*Xes don't appear to.

On Windows, at least according to Microsoft's documentation, st_ctime
*is* the creation time.  Hopefully that's not the result of confusion on
the part of somebody at Microsoft.

Change-Id: I20743703f6ef66e40dff9004dc91bed46af6fad0
Reviewed-on: https://code.wireshark.org/review/18378
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 24 insertions, 0 deletions

diff --git a/fileset.c b/fileset.c
index b1e636c3d5..06cf335f9c 100644
--- a/fileset.c
+++ b/fileset.c
@@ -186,7 +186,19 @@ fileset_update_file(const char *path)
 
             if (entry_list) {
                 entry = (fileset_entry *) entry_list->data;
+#ifdef __WIN32
+                /* Microsoft's documentation says this is the creation time */
                 entry->ctime    = buf.st_ctime;
+#else /* _WIN32 */
+                /* UN*X - do we have a creation time? */
+#if defined(HAVE_STRUCT_STAT_ST_BIRTHTIME)
+                entry->ctime    = buf.st_birthtime;
+#elif defined(HAVE_STRUCT_STAT___ST_BIRTHTIME)
+                entry->ctime    = buf.__st_birthtime;
+#else /* nothing */
+                entry->ctime    = 0;
+#endif /* creation time on UN*X */
+#endif /* _WIN32 */
                 entry->mtime    = buf.st_mtime;
                 entry->size     = buf.st_size;
             }
@@ -220,7 +232,19 @@ fileset_add_file(const char *dirname, const char *fname, gboolean current)
 
             entry->fullname = g_strdup(path);
             entry->name     = g_strdup(fname);
+#ifdef __WIN32
+            /* Microsoft's documentation says this is the creation time */
             entry->ctime    = buf.st_ctime;
+#else /* _WIN32 */
+            /* UN*X - do we have a creation time? */
+#if defined(HAVE_STRUCT_STAT_ST_BIRTHTIME)
+            entry->ctime    = buf.st_birthtime;
+#elif defined(HAVE_STRUCT_STAT___ST_BIRTHTIME)
+            entry->ctime    = buf.__st_birthtime;
+#else /* nothing */
+            entry->ctime    = 0;
+#endif /* creation time on UN*X */
+#endif /* _WIN32 */
             entry->mtime    = buf.st_mtime;
             entry->size     = buf.st_size;
             entry->current  = current;