Say there is an empty directory and I run the commands >file1 and touch file2 while in that directory, but I forget which command created which file.
I don't know what command I ran first and I don't have access to command history.
The files are untampered. Is there a way to tell which file was obtained from touch and what file was obtained from redirection?
No, there will be no difference in the resulting files.
@Hkoof is correct.
Neither :> nor touch actually create files, they only send requests to the underlying management system which populates the attributes with the information it needs, and these are the built-in attributes concerned only with managing the files and their security (who, when, what is allowed to be done etc).
There is no built-in attribute which can be set to record how the 'creation process' was started simply because this information has no use in the management of the system. The how in file creation is the responsibility of the user.
