File creation date of vfat / fat32 files on linux

snail · 06-02-2009, 04:58 PM

I have a vfat USB drive mounted on linux as vfat.
Since the vfat / fat32 timestamps also have a file creation time, is there any way to get the file creation time for all files on the USB ?
I tried using the FAT_IOCTL_GET_ATTRIBUTES ioctl which returns the dos attributes.
However I did not get any system call / ioctl / tool which will read the dos timestamps in linux.

unSpawn · 06-03-2009, 03:55 AM

Isn't it just a conceptual case of MAC times being handled differently? Doesn't 'stat -c "%Z %N" /path/to/file' return a ctime value which VFAT and NTFS use as creation time?

snail · 06-03-2009, 12:37 PM

No it does not.
From my windows box when I checked the creation time of the file on the USB it gave this -- Tue May 26 13:33:49 PDT 2009

And none of the timestamps returned by the stat match this --
stat download.JPG
File: `download.JPG'
Size: 223271 Blocks: 440 IO Block: 4096 regular file
Device: 801h/2049d Inode: 28 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2009-05-26 13:37:47.000000000 -0700
Modify: 2009-05-26 13:37:47.000000000 -0700
Change: 2009-06-03 10:31:13.000000000 -0700

unSpawn · 06-03-2009, 05:56 PM

When I do a 'stat' on a file on a VFAT USB stick and run a forensic imager they both show the same MAC times.
Without more details from you there's not much else to help you with I think.