ext4 filesystem I was able to read out the creation time of a file using the approach here. As a result I am indeed provided with a table featuring the
crtime (creation time) of the inode(respective file) in question.
What confuses me and to which I could not find an answer in the
man debugfs is why it shows me 2 lines with
crtime, moreover not even being the same time.
This is the output I get
$ sudo debugfs -R "stat <274742>" /dev/sda2 debugfs 1.43.1 (08-Jun-2016) Inode: 274742 Type: regular Mode: 0644 Flags: 0x80000 Generation: 3666549610 Version: 0x00000000:00000001 User: 1000 Group: 1000 Project: 0 Size: 0 File ACL: 0 Directory ACL: 0 Links: 0 Blockcount: 0 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016 atime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016 mtime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016 crtime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016 crtime: 0x57b4c632:(1e30ee34) -- Wed Aug 17 22:16:50 2016 Size of extra inode fields: 32
Also note that the second (and not realy correct)
crtime is in brackets and equals the
mtime, since I saved to the file obviously twice.
Here is Solutions:
This is the result of an editing error in the e2fsprogs patch debugfs: add support to properly set and display extended timestamps. The second crtime: line ought to be dtime:.
if (inode->i_dtime) fprintf(out, "%scrtime: 0x%08x:(%08x) -- %s", prefix, large_inode->i_dtime, large_inode->i_ctime_extra, inode_time_to_string(inode->i_dtime, large_inode->i_ctime_extra));
I submitted a bug report.
Note: Use and implement solution 1 because this method fully tested our system.
Thank you 🙂