LinuxQuestions.org - How do I preserve "crtime" (creation/birth time) when copying from Windows NTFS to Linux EXT4?

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - How do I preserve "crtime" (creation/birth time) when copying from Windows NTFS to Linux EXT4? (https://www.linuxquestions.org/questions/linux-newbie-8/how-do-i-preserve-crtime-creation-birth-time-when-copying-from-windows-ntfs-to-linux-ext4-4175625229/)

Quote:

Originally Posted by syg00 (Post 6341809)

A quick search found this which you might be interested to read. It implies that if you can get a list of the times you can indeed reset the crtime of the copied files - at least on ext4. Obviously, using the stat output works best for that script.

That is an amazing and very interesting find! I have to do this backup in under two months. We'll see what my limited bash skill can do in that time.

If EXIF data is only for photos, then that is not the solution I need. To lose all my crtimes would be like telling archeologists that all date records are to be erased, and they have to sort specimens by carbon-dating from now on. Some of my files and directories I've named starting with the date _d20220327su, and some digital cameras use this convention. It's extremely helpful, but not done enough.

Quote:

Originally Posted by ans1 (Post 5828872)

Hello and thanks for the help.

I'm attempting to move from Windows-7 to Debian testing.

How do I preserve "crtime" (creation/birth time) when copying from Windows NTFS to Linux EXT4?

I'm trying to copy files from a Windows-7 NTFS computer to a Debian/testing/Buster EXT4 computer (kernel version 4.14).
Unfortunately, the original "creation/birth time" gets lost during this copy.
Instead, the "creation/birth time" of the copied files gets changed to the time of copying.

Below is what I've tried:
On Windows-7 computer, copy files (including creation/birth time, "crtime") to USB stick:

<plug-in NTFS USB stick, E: drive>
<format USB stick to NTFS>
robocopy C:\TEST E:\TEST /MIR /COPYALL /DCOPY:T /SECFIX /TIMFIX
<use "Windows Explorer" to verify correct file creation time ("crtime") on NTRF USB stick>
<eject NTFS USB stick>

On Debian/testing/Buster computer, copy files (including creation/birth time, "crtime") from USB stick:

<plug-in NTFS USB stick>
rsync -avzhHEA --delete <NTFS USB mount point>/TEST ~

Check "crtime" on a file copied from NTFS to EXT4 using rsync:

sudo debugfs -R 'stat /home/<user>/TEST/file' <device>

"debugfs" reports that "crtime" (creation/birth time), "ctime", and "atime" are all changed when copying to EXT4. They are not their Windows NTFS values.
Only "mtime" (last modify time) is the correct Windows NTFS value.

So this procedure failed to copy the original NTFS "crtime".
Instead, it changed "crtime" to the time the file was copied to EXT4. (Additionally, "ctime" and "atime" were also changed when copied to EXT4. Only "mtime" was preserved.)

Further investigations:
I replaced "rsync" with "cp -p". "cp -p" also fails to preserve "crtime". So the problem is not unique to "rsync".

Next I looked into the file systems. Both NTFS & EXT4 file systems support "creation timestamp" (https://en.wikipedia.org/wiki/Compar...f_file_systems).
So the file systems are not the problem.

Next I looked into the kernel:
2010: discussions on adding "crtime" to kernel/stat were put on hold for 5 years, until 2015 (http://lists.gnu.org/archive/html/co.../msg00047.html).
2016: "crtime" (creation/birth time) added to kernel/stat version 4.11 (https://git.kernel.org/pub/scm/linux...3e1bd296c8493f).
So the kernel should handle "crtime" today, 2018.

Summary:
The ability to read the "crtime" was added to kernel version 4.11 in 2016.
It's now 2018, and I'm using kernel version 4.14.
So the ability to access "crtime" should be present within the kernel.
Both file systems (NTFS and EXT4) support "crtime".
I've verified that "crtime" is present and correct on the files contained on the NTFS USB stick.
I've instructed both "rsync" and "cp" to copy all of the file parameters to the EXT4 Linux computer.
Yet files copied to EXT4 fail to retain their original creation/birth times (crtime).

What am I doing wrong?
Is there a kernel module or package I need to install?
How do I preserve "crtime" (creation/birth time) when copying from NTFS to EXT4?

Thanks for the help.

In Windows,
We use http://github.com/mart-wu/Ext3Fsd mount ext4 partition. Then the ext partition is mounted on the windows system just like the local partition and accesses normally as with NTFS,

At this time, we can use some software under windows, such as: rsync, SyncToy, UrBackup and other software that can retain the file creation time in windows, we synchronize the ntfs file to EXT4,
Compare their creation time, and then mount it to the deeping Linux system in ext4, compare their creation time, which has been kept synchronized.

？？ Windows can keep the creation time with github matt-wu/Ext3Fsd, but Linux can't?

Windows Ext3Fsd mount ext4 can keep "crtime" (creation/birth time)

In Windows, We use https://github.com/matt-wu/Ext3Fsd mount ext4 partition. Then the ext partition is mounted on the windows system just like the local partition and accesses normally as with NTFS,

At this time, we can use some software under windows, such as: rsync, SyncToy, UrBackup and other software that can retain the file creation time in windows, we synchronize the ntfs file to EXT4, Compare their creation time, and then mount it to the deeping Linux system in ext4, compare their creation time, which has been kept synchronized.

Windows can keep the creation time with github matt-wu/Ext3Fsd, but Linux can't.

If you really need those timestamps, you could use debugfs on Linux to set timestamps again if you write timestamps to a file. You will need sudo for debugfs and set_inode_field in debugfs. If you want something entirely in a Bash script something like this may help.

Quote:

sudo debugfs -w -R "set_inode_field $inode crtime $time" /dev/sda1

With $inode as inode of file on ext4 system from "stat" and $time being time in format of seconds.nanos and /dev/sda1 is current operating system device identifier. If you can keep it on NTFS I think some time in future there will be a script for transfer. In that command crtime could be ctime depending on your Linux, what are you on? I think what you are missing is -w, open with write mode. Read only is default. I think this CAN BE DONE on ext4 and Debian. X E.

You may need to copy all timestamps in order: created at, changed at, modified at, accessed at. You may use debugfs for first two and touch for second two. Do not set ones that are unimportant. You may save current copied with times for that. X E.

I've struggled and asked about this very issue. It appears that the only option is to settle with ctime or, absurd, switch to mac os with homebrew

disk_bearing, where is your thread and how may I help. In man debugfs it does indeed claim to be able to set crtime. Like my thread on it.
https://www.linuxquestions.org/quest...fs-4175732530/
X E.

https://linux.die.net/man/8/debugfs
Look up or get debugfs and use man debugfs for more info. man debugfs is also possibly online some.

debugfs -w -R 'set_inode_field <'$inode'> crtime '$formatted_time'' "$device"

debugfs -w -R 'set_inode_field <'$inode'> ctime '$formatted_time'' "$device"

Try like those in Bash. X E.

https://unix.stackexchange.com/quest...4fs-filesystem
Do not do this on a main file system, use a bootable USB. X E.

Quote:

Originally Posted by maybeJosiah (Post 6476109)

disk_bearing, where is your thread and how may I help. In man debugfs it does indeed claim to be able to set crtime. Like my thread on it.
https://www.linuxquestions.org/quest...fs-4175732530/
X E.

Thanks for the referral. I was doing a one time migration to linux so now it is what it is.

Maybe just record timestamps to a file with bash or otherwise keep them and maybe soon you can restore. X E.

Word from Theodore Ts'o, you may need more to have them survive 2037. X E.