how to learn "when was the distro installed on this box" -- Ubuntu family

SaintDanBert · 06-17-2010, 03:39 PM

So I spin the media and "fresh install" Ubuntu Jaunty onto my laptop.
... time passes ...
Now I want to discover the date that I accomplished that install.
Only the Lord knows what I've added changed or deleted since then
and He's not telling me.

Somewhere on this laptop is a file or similar that I might view
that will tell me when I spun the distro installer. Preferably, I
want a resource I might inspect with 'find' or 'tar' or 'make' or
some scriptable date testing.

The file /etc/lsb-release reports the distro details but not the install date.

SUGGESTION: Add the install date to the specification of this file's contents.

Code:

user@host:/path/ $ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=9.04
DISTRIB_CODENAME=jaunty
DISTRIB_DESCRIPTION="Ubuntu 9.04"
user@host:/path/ $

File system creation dates are not definitive -- I might be re-using
an existing partition even if I do a fresh install.

Q1: Can someone tell me where to look?

~~~ 0;-Dan

knudfl · 06-17-2010, 03:58 PM

May be a good idea to do this command at install time :
dpkg --get-selections > install$time`date '+%Y-%m-%d-%T'`

Later, when one or more extra packages are installed :
ls -tl /var/lib/dpkg/info/ | grep list > last-packages
( $time`date '+%Y-%m-%d'` can be added too ).
.....

rweaver · 06-17-2010, 04:02 PM

You would probably get better response adding that suggestion to the ubuntu site... not that it's really a tremendously relevant or significant piece of information.

You could check the sources.list file in your /etc/apt directory if you've never made modifications to it or creation dates on files/directories in less used areas of the file systems to get some idea, but that's going to be a pretty hard number to pin down directly. A simple "date >> /etc/initial.installation" would probably be sufficient for future installs if thats something you feel you need to know.

BirdRacer · 06-17-2010, 04:03 PM

If you haven't recompiled your kernel, this command will give you the kernel build date/time:

Code:

uname -v

SaintDanBert · 06-17-2010, 05:20 PM

Lots of ideas about what to do ...
(grin) ... if you think about it in advance.
I didn't think about it in advance.

Now I have this system and am trying to do archeology (or maybe forensics).

What I do know goes like this:
1. mount shows details about the '/' file system

Code:

user@host:/path $ mount

/dev/sda6 on / type ext3 (rw,relatime,errors=remount-ro)

2. tune2fs diggs deeper into the details for the file system

Code:

user@host:/path $ sudo tune2fs -l /dev/sda6 | grep -i created

Filesystem created:       Wed Feb 24 17:26:41 2010

3. There are config files in the /etc folder

Code:

user@host:/path/ $ ls -ltrh /etc | grep -i "2010-02-24"

lrwxrwxrwx  1 root root     13 2010-02-24 17:30 motd -> /var/run/motd
-rw-r--r--  1 root root    253 2010-02-24 17:40 hosts
-rw-r--r--  1 root root      8 2010-02-24 17:40 hostname
drwxr-xr-x  2 root root   4.0K 2010-02-24 17:42 console-setup
-rw-r--r--  1 root root    117 2010-02-24 17:42 usplash.conf
-rw-r--r--  1 root root      7 2010-02-24 17:42 papersize
-rw-r--r--  1 root root    167 2010-02-24 17:43 kernel-img.conf
drwxr-xr-x  2 root root   4.0K 2010-02-24 17:53 dictionaries-common
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:35 security
drwxr-xr-x  4 root root   4.0K 2010-02-24 19:38 dhcp3
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:38 cron.weekly
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:38 cron.monthly
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:38 cron.hourly
drwxr-xr-x  3 root root   4.0K 2010-02-24 19:38 update-manager
drwxr-xr-x  3 root root   4.0K 2010-02-24 19:38 udev
-rw-r--r--  1 root root    198 2010-02-24 19:38 modules
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:38 gnome-app-install
drwxr-xr-x  3 root root   4.0K 2010-02-24 19:39 apport
drwxr-xr-x  3 root root   4.0K 2010-02-24 19:39 sgml
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:39 profile.d
drwxr-xr-x  4 root root   4.0K 2010-02-24 19:39 mono
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:39 purple
drwxr-xr-x  4 root root   4.0K 2010-02-24 19:39 ssl
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:39 pulse
drwxr-xr-x  5 root root   4.0K 2010-02-24 19:40 dbus-1
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:40 bluetooth
drwxr-xr-x  2 root root   4.0K 2010-02-24 19:40 checkbox.d
-rw-------  1 root saint     0 2010-02-24 19:41 mtab.fuselock
drwxr-xr-x  2 root root   4.0K 2010-02-24 20:02 gromit
drwxr-xr-x  3 root root   4.0K 2010-02-24 20:15 emacs22
drwxr-xr-x  3 root root   4.0K 2010-02-24 20:15 emacs
drwxr-xr-x  2 root root   4.0K 2010-02-24 20:15 dictd
drwxr-xr-x  2 root root   4.0K 2010-02-24 20:39 python2.5
drwxr-xr-x  2 root root   4.0K 2010-02-24 20:40 timidity
drwxr-xr-x  2 root root   4.0K 2010-02-24 20:40 wildmidi
-rw-r--r--  1 root root   1.4K 2010-02-24 21:01 fstab~
-rw-r--r--  1 root root   1.4K 2010-02-24 21:04 fstab
drwxr-xr-x  2 root root   4.0K 2010-02-24 23:15 synce

One candidate would be to use the output of tune2fs directly. It presents a clean date string. This presumes that you created the root file system during the install. I always do, but others might have different experiences.

Another candidates include /etc/kernel-img.conf. Does anyone know when and why this file might get altered?

Yet another candidate is /etc/hostname if one picks
a host name during install and never changes it. Does anyone know
when and why this might get altered?

When I ask about alterations, I'm not speaking of end-user modifications. Instead I speak of side effects of package updates or other mostly invisible, auto-magic system administration. If the operator nut twists a wrench, all other bets are off.

~~~ 0;-Dan

genenj · 06-22-2010, 10:18 AM

I am no expert so please forgive me if this is foolish...

I know Ubuntu has a /var/log/installer directory (I don't know about other distros).

I suggest looking in the /var/log/installer directory.

There are a number of files created (timestamped) during the installation.

Just a suggestion.

genenj

tredegar · 06-22-2010, 02:27 PM

Some things just aren't 100% "provable":

"I have seen 10,000 ravens. They were all black. Therefore all ravens are black."
Likely, and possible, but not proven.

"I have examined all ravens that exist. They were all black. Therefore all ravens are black."
Highly likely, but still unproven. Maybe an albino raven hatched two minutes ago.

"Ravens are defined as birds that are ..., .., and coloured black". "All ravens are black".
Correct, but not very helpful, apart from "here's the definition of a raven, it must be black, so if it's not black it's not a raven by definition".

You could search your entire filesystem, and find the 200 oldest file creation times. When I refer to "time" this refers both to the date and the time on that date. [ See find and ctime ]

That would probably be the installation time, especially if you found "oldest" files with creation times differing by only minutes or seconds. This evidence could be reinforced if you could show that the installer used by that distro, at that time, created files in a certain order, and the creation times of different files match the installers file-creation procedure.

This could be manipulated, but not very easily.

[I like forensics]

HTH

SaintDanBert · 06-22-2010, 03:27 PM

Quote:

Originally Posted by tredegar

Some things just aren't 100% "provable":

"I have seen 10,000 ravens. They were all black. Therefore all ravens are black."
Likely, and possible, but not proven.
...
[I like forensics]

HTH

I like ravens ... "Squawk! Nevermore."

Any file may have its datetimestamp tinkered in various ways.
That is why I say they are problematic. Even if there were a smoking
gun text string somewhere, that, too, is easy to edit.

I'm hoping that there is a standard issue date-installed marker somewhere. I have yet to check out the file://var/log/installer mentioned elsewhere in this thread.

~~~ 0;-Dan

brucehinrichs · 06-22-2010, 04:18 PM

Quote:

2. tune2fs diggs deeper into the details for the file system
Code:

user@host:/path $ sudo tune2fs -l /dev/sda6 | grep -i created

Filesystem created: Wed Feb 24 17:26:41 2010

Maybe I'm missing something, but doesn't this info tell you when the system was installed (by pinpointing when the FS was created)?

tredegar · 06-22-2010, 04:20 PM

Quote:

I have yet to check out the file://var/log/installer

"No such file".

If you think about it, there really isn't any good reason to record when a system was installed.

All that really matters is the version numbers of the software that are available / running.

May I ask why you are asking this question?

genenj · 06-23-2010, 09:57 AM

My /var/log/installer directory has the files:
initial-status.gz
partman
syslog
hardware-summary
lsb-release
status

As well as another directory called cdebconf.

I don't really need to know when my machine was installed, I have only consulted the syslog file when I was debugging a preseed file.