How to get file creation time (Ext4, ntfs-3g)?
I know newer filesystems support crtime values, even to nanoseconds granularity. Ext4 does it, and NTFS mounted via ntfs-3g should expose it. Still, what is the command to get these values??
getfattr -d <some file> gives me zero results, and as far as I know ls does not have means to access creation time. getfattr -n ntfs_crtime /mnt/<some ntfs fs> gives me "Operation not opermitted"..? I know about the difference between ctime=inode change time and crtime=creation time/file birth time. I want to migrate a NTFS partition to Ext4 without losing the creation dates... |
The getfattr command returns extended file attributes - things like SELinux settings. Look at the -c option of the ls command to expose file creation times. For example:
Code:
[Peter ~]$ ls -lc /Vista/boot/ |
That's not crtime - even on ext4.
The crtime is maintained (in ext4), but I don't think there is a (convenient) means of extracting it (yet). If you get a files inode (say 9999), you can do this against the filesystem itself (include the < >) Code:
debugfs -R 'stat <9999>' /dev/sda? |
@PTrenholme: as syg00 sais: that's change time (ctime), not crtime!
@syg00: your command worked (and did send the hdd into a second of strange grrrr sounds...). Example output: Quote:
(Actually I would need to read out crtime via perl... - ideas?) |
Quote:
There is a B option in the find command, but -- on my Fedora system using an ext4 system -- I get this: Code:
$ find ./ -newerBt "yesterday" The debugfs suggestion works for ext4, but I don't think that it would work for a ntfs file, since the NTFS doesn't actually have an inode. When I tried it, I got this: Code:
$ ls -i /Vista/Users/ |
Debugfs is part of e2fsprogs - I wouldn't expect it to work on any other f/s; sorry if I wasn't clear on that. Merely offered to prove the data is there.
There have been rumblings on lkml to get the data out, but it would involve other code changes all over the place. And occupy more in kernel space - which the devs are dead against anytime. |
Quote:
Actually I got the crtime squeezed out of NTFS with a little util called ntfsinfo. The only problem was that my mounted volume would only be probable with the -f force option, and this marked the NTFS volume as "dirty". Next time I booted the volume under Windows, chkdsk came up... Very unsatisfying that you can only probe for crtime from Linux on offline/unmounted NTFS volumes... |
Linux filesystems do not store the creation time.
|
Rubbish. Read the entire thread.
|
May I say it again: "Very unsatisfying that you can only probe for crtime from Linux on offline/unmounted NTFS volumes"!!
Any other ideas to do it guys? |
NTFS is Microsoft proprietary. It is not a Linux filesystem, nor are its internal released publicly.
You're lucky it's supported at all - maybe you should offer some assistance to the linux-ntfs project to include it rather than moan about it. |
All times are GMT -5. The time now is 07:34 AM. |