@InfoSecRamblins See also "relatime" option (on by default in most modern Linux) which has similar bad outcomes for forensics #BSidesKC