>>>>> "David" == David T Lewis <lewis at mail.msen.com> writes:

David> Looks OK to me (on Linux, 3.6g-2 VM). My /etc/hosts shows a creationTime earlier
David> than modificationTime as expected.

First, there's no such thing as creation time on Unix.  So I have
no idea what the Unix VM is reporting.

Second, if it's reporting ctime, the ctime is updated when the mtime
is updated, so absent a call to utime(2) (which sets the ctime to
"now" and the atime and mtime to arbitrary values), the ctime is
always the same or newer than the mtime.  The rules are:

        atime - modified when file is opened for read, or via utime()
        mtime - modified when file is opened for write, or via utime()
        ctime - modified when file is opened for write, or when any
                metadata is changed (renamed, linked, utime'd, chowned, etc)

None of those are "creation time".

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn at stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!