Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I know newer filesystems support crtime values, even to nanoseconds granularity. Ext4 does it, and NTFS mounted via ntfs-3g should expose it. Still, what is the command to get these values??
getfattr -d <some file>
gives me zero results, and as far as I know ls does not have means to access creation time.
getfattr -n ntfs_crtime /mnt/<some ntfs fs> gives me "Operation not opermitted"..?
I know about the difference between ctime=inode change time and crtime=creation time/file birth time.
I want to migrate a NTFS partition to Ext4 without losing the creation dates...
The getfattr command returns extended file attributes - things like SELinux settings. Look at the -c option of the ls command to expose file creation times. For example:
Code:
[Peter ~]$ ls -lc /Vista/boot/
total 1016
-rwxrwxrwx. 1 root root 28672 Apr 6 16:57 bcd
-rwxrwxrwx. 1 root root 262144 Apr 6 16:57 BCD.LOG
-rwxrwxrwx. 2 root root 262144 Dec 19 03:51 BCD.LOG1
-rwxrwxrwx. 2 root root 0 Dec 19 03:51 BCD.LOG2
-rwxrwxrwx. 1 root root 1024 Dec 19 03:51 bootfix.bin
-rwxrwxrwx. 1 root root 65536 Dec 19 03:51 bootstat.dat
[Peter ~]$ ls -lc Scripts/tmp
total 8
-rwxr-xr-x. 1 Peter Peter 673 Jun 7 17:27 scramble
-rwxr-xr-x. 1 Peter Peter 821 Jun 7 17:27 scramble~
Last edited by PTrenholme; 06-14-2010 at 07:05 PM.
That's not crtime - even on ext4.
The crtime is maintained (in ext4), but I don't think there is a (convenient) means of extracting it (yet). If you get a files inode (say 9999), you can do this against the filesystem itself (include the < >)
@PTrenholme: as syg00 said: that's change time (ctime), not crtime!
Oops! My bad! (Again.) One of these days I need to learn how to read better.
There is a B option in the find command, but -- on my Fedora system using an ext4 system -- I get this:
Code:
$ find ./ -newerBt "yesterday"
find: This system does not provide a way to find the birth time of a file.
find: invalid predicate `-newerBt'
so that's not much help.
The debugfs suggestion works for ext4, but I don't think that it would work for a ntfs file, since the NTFS doesn't actually have an inode. When I tried it, I got this:
Code:
$ ls -i /Vista/Users/
25503 All Users 25504 Default User 63970 Judy 15441 Public
15405 Default 25502 desktop.ini 217 Peter
$ sudo debugfs -R 'stat <217>' /dev/sda3
debugfs 1.41.10 (10-Feb-2009)
/dev/sda3: Bad magic number in super-block while opening filesystem
stat: Filesystem not open
Debugfs is part of e2fsprogs - I wouldn't expect it to work on any other f/s; sorry if I wasn't clear on that. Merely offered to prove the data is there.
There have been rumblings on lkml to get the data out, but it would involve other code changes all over the place.
And occupy more in kernel space - which the devs are dead against anytime.
... since the NTFS doesn't actually have an inode. When I tried it, I got this...
I did the same on an ntfs-3g mounted volume and got the same error.
Actually I got the crtime squeezed out of NTFS with a little util called ntfsinfo.
The only problem was that my mounted volume would only be probable with the -f force option, and this marked the NTFS volume as "dirty". Next time I booted the volume under Windows, chkdsk came up...
Very unsatisfying that you can only probe for crtime from Linux on offline/unmounted NTFS volumes...
NTFS is Microsoft proprietary. It is not a Linux filesystem, nor are its internal released publicly.
You're lucky it's supported at all - maybe you should offer some assistance to the linux-ntfs project to include it rather than moan about it.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.