File System Creation Time

meshcurrent · 02-08-2009, 03:56 AM

I am trying to determine the date/time a file system was created. In particular, I am interested in ReiserFS and JFS. Initially, I considred using the ctime as an indicator, but it turned out not to be a reliable one. Then, I looked into the debugreiserfs and jfs_debugfs utilities, but they did not seem to be able to obtain that information.

Any suggestions are appreciated.

Youssef Eldakar
Bibliotheca Alexandrina

unSpawn · 02-08-2009, 05:13 AM

In UNIX, it is not possible to tell the actual creation time of a file (also see: http://www.securityfocus.com/infocus/1738).

meshcurrent · 02-08-2009, 06:40 AM

Thank you for the link with information on ctime, mtime, and atime, which explains how it is not possible to tell when a file was created in Unix. However, I am trying to determine when a file system, not a file, was created.

Youssef Eldakar
Bibliotheca Alexandrina

jschiwal · 02-08-2009, 07:03 AM

I didn't see a date entry using "udevinfo -q all -n /dev/sda1" or using "sudo /usr/sbin/hwinfo --block". Perhaps some filesystems have a date stamp in the structure, but it would depend on the filesystem.

In ext3, I think the only date used is the last time checked.

unSpawn · 02-08-2009, 07:29 AM

Quote:

Originally Posted by meshcurrent

I am trying to determine when a file system, not a file, was created.

ROTFL. Short read there, my apologies. ReiserFS and XFS I don't know about, but listing the superblock contents in ExtFS (debugfs, tune2fs) shows a "Filesystem created" entry. I doubt it's worth much though (as in "forensically irrefutable").

jschiwal · 02-08-2009, 11:46 AM

Did you use dumpe2fs?

I should have looked for that.

Code:

...
Filesystem created:       Wed Dec  3 01:05:02 2008
Last mount time:          Tue Jan 13 07:13:29 2009
Last write time:          Tue Jan 13 07:13:29 2009
...