LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
LinkBack Search this Thread
Old 06-14-2010, 04:02 PM   #1
isync
Member
 
Registered: Feb 2007
Posts: 32

Rep: Reputation: 15
Question How to get file creation time (Ext4, ntfs-3g)?


I know newer filesystems support crtime values, even to nanoseconds granularity. Ext4 does it, and NTFS mounted via ntfs-3g should expose it. Still, what is the command to get these values??

getfattr -d <some file>

gives me zero results, and as far as I know ls does not have means to access creation time.

getfattr -n ntfs_crtime /mnt/<some ntfs fs> gives me "Operation not opermitted"..?

I know about the difference between ctime=inode change time and crtime=creation time/file birth time.
I want to migrate a NTFS partition to Ext4 without losing the creation dates...
 
Old 06-14-2010, 07:04 PM   #2
PTrenholme
Senior Member
 
Registered: Dec 2004
Location: Olympia, WA, USA
Distribution: Fedora, (K)Ubuntu
Posts: 4,141

Rep: Reputation: 329Reputation: 329Reputation: 329Reputation: 329
The getfattr command returns extended file attributes - things like SELinux settings. Look at the -c option of the ls command to expose file creation times. For example:
Code:
[Peter ~]$ ls -lc /Vista/boot/
total 1016
-rwxrwxrwx. 1 root root  28672 Apr  6 16:57 bcd
-rwxrwxrwx. 1 root root 262144 Apr  6 16:57 BCD.LOG
-rwxrwxrwx. 2 root root 262144 Dec 19 03:51 BCD.LOG1
-rwxrwxrwx. 2 root root      0 Dec 19 03:51 BCD.LOG2
-rwxrwxrwx. 1 root root   1024 Dec 19 03:51 bootfix.bin
-rwxrwxrwx. 1 root root  65536 Dec 19 03:51 bootstat.dat
[Peter ~]$ ls -lc Scripts/tmp
total 8
-rwxr-xr-x. 1 Peter Peter 673 Jun  7 17:27 scramble
-rwxr-xr-x. 1 Peter Peter 821 Jun  7 17:27 scramble~

Last edited by PTrenholme; 06-14-2010 at 07:05 PM.
 
Old 06-14-2010, 08:35 PM   #3
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,821

Rep: Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924
That's not crtime - even on ext4.
The crtime is maintained (in ext4), but I don't think there is a (convenient) means of extracting it (yet). If you get a files inode (say 9999), you can do this against the filesystem itself (include the < >)
Code:
debugfs -R 'stat <9999>' /dev/sda?

Last edited by syg00; 06-14-2010 at 08:36 PM.
 
Old 06-16-2010, 09:07 AM   #4
isync
Member
 
Registered: Feb 2007
Posts: 32

Original Poster
Rep: Reputation: 15
@PTrenholme: as syg00 sais: that's change time (ctime), not crtime!

@syg00: your command worked (and did send the hdd into a second of strange grrrr sounds...). Example output:
Quote:
Inode: 5505072 Type: regular Mode: 0644 Flags: 0x80000
Generation: 3777246081 Version: 0x00000000:00000001
User: 1000 Group: 1000 Size: 65666
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 136
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4c179224:b06523cc -- Tue Jun 15 16:45:56 2010
atime: 0x4c17922d:472056f4 -- Tue Jun 15 16:46:05 2010
mtime: 0x4c17921f:720ab41c -- Tue Jun 15 16:45:51 2010
crtime: 0x4c17921f:303ce20c -- Tue Jun 15 16:45:51 2010
Size of extra inode fields: 28
EXTENTS:
(0-16): 22057124-22057140
And that's the only way to get this? Yes?
(Actually I would need to read out crtime via perl... - ideas?)
 
Old 06-16-2010, 04:24 PM   #5
PTrenholme
Senior Member
 
Registered: Dec 2004
Location: Olympia, WA, USA
Distribution: Fedora, (K)Ubuntu
Posts: 4,141

Rep: Reputation: 329Reputation: 329Reputation: 329Reputation: 329
Quote:
Originally Posted by isync View Post
@PTrenholme: as syg00 said: that's change time (ctime), not crtime!
Oops! My bad! (Again.) One of these days I need to learn how to read better.

There is a B option in the find command, but -- on my Fedora system using an ext4 system -- I get this:
Code:
$ find ./ -newerBt "yesterday"
find: This system does not provide a way to find the birth time of a file.
find: invalid predicate `-newerBt'
so that's not much help.

The debugfs suggestion works for ext4, but I don't think that it would work for a ntfs file, since the NTFS doesn't actually have an inode. When I tried it, I got this:
Code:
$ ls -i /Vista/Users/
25503 All Users  25504 Default User  63970 Judy  15441 Public
15405 Default    25502 desktop.ini     217 Peter

$ sudo debugfs -R 'stat <217>' /dev/sda3
debugfs 1.41.10 (10-Feb-2009)
/dev/sda3: Bad magic number in super-block while opening filesystem
stat: Filesystem not open
 
Old 06-16-2010, 05:24 PM   #6
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,821

Rep: Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924
Debugfs is part of e2fsprogs - I wouldn't expect it to work on any other f/s; sorry if I wasn't clear on that. Merely offered to prove the data is there.
There have been rumblings on lkml to get the data out, but it would involve other code changes all over the place.
And occupy more in kernel space - which the devs are dead against anytime.
 
Old 06-16-2010, 08:27 PM   #7
isync
Member
 
Registered: Feb 2007
Posts: 32

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by PTrenholme View Post
... since the NTFS doesn't actually have an inode. When I tried it, I got this...
I did the same on an ntfs-3g mounted volume and got the same error.

Actually I got the crtime squeezed out of NTFS with a little util called ntfsinfo.
The only problem was that my mounted volume would only be probable with the -f force option, and this marked the NTFS volume as "dirty". Next time I booted the volume under Windows, chkdsk came up...

Very unsatisfying that you can only probe for crtime from Linux on offline/unmounted NTFS volumes...
 
Old 06-17-2010, 07:25 AM   #8
MTK358
LQ 5k Club
 
Registered: Sep 2009
Posts: 6,443
Blog Entries: 3

Rep: Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713
Linux filesystems do not store the creation time.
 
Old 06-17-2010, 07:53 AM   #9
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,821

Rep: Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924
Rubbish. Read the entire thread.
 
Old 06-19-2010, 09:36 AM   #10
isync
Member
 
Registered: Feb 2007
Posts: 32

Original Poster
Rep: Reputation: 15
Angry

May I say it again: "Very unsatisfying that you can only probe for crtime from Linux on offline/unmounted NTFS volumes"!!

Any other ideas to do it guys?
 
Old 06-19-2010, 05:49 PM   #11
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,821

Rep: Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924Reputation: 924
NTFS is Microsoft proprietary. It is not a Linux filesystem, nor are its internal released publicly.
You're lucky it's supported at all - maybe you should offer some assistance to the linux-ntfs project to include it rather than moan about it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
File System Creation Time meshcurrent Linux - General 5 02-08-2009 11:46 AM
file creation time dina3e Linux - Newbie 2 03-25-2008 12:45 PM
File Creation Time? enine Linux - General 9 05-17-2006 11:46 AM
list file creation time allelopath Linux - General 2 08-02-2005 09:02 PM
Time of creation of a file proxyserver Linux - Software 2 04-11-2004 10:29 AM


All times are GMT -5. The time now is 01:42 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration