How "tar" command manages to "see" changed files between two incremental backups

Question

How tar command checks whether a file is changed or not? How tar "knows" that this file is changed and it has to go in the next incremental backup?

I have some assumptions:

• it may compare "mtime";
• it may compare "ctime";
• it may compare the contents (using something like md5sum);

When I say tar I mean GNU tar.

Answer 1

I did some tests with GNU tar and found that:

• When you are updating an archive i.e. tar uvvf test.tar test_folder only the mtime is used for checking if the file is changed.

• When you are creating an incremental archive using a snapshot file as in tar cvvf test.tar --listed-incremental=snaphot test_folder both mtime and ctime are used to check for changes. This is done because changing some attribute of the file (i.e. the owner) changes ctime. Tar is used to backup not only the contents of the files, but also their attributes.

• And finally, tar doesn't checksum the files in the archive and if you manage to spoof the file system and change the contents of the file, but not change their mtime and ctime tar will not include this file in the next increment.

For reference about atime, mtime and ctime I've used this http://www.unix.com/tips-tutorials/20526-mtime-ctime-atime.html.

Answer 2

If you are referring to GNU tar, then as per the manual, it checks the modified time against the one in the archive. So this would be mtime.

http://www.gnu.org/software/tar/manual/html_section/Advanced-tar.html#SEC62

For a file that had been modified, ctime would remain the same, so wouldn't be a valid check. tar does not do md5 checks.