Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created an NTFS logical volume on my Linux system for Windows file storage because I want to retain the creation date of my files (I would probably zip them into an archive and then unzip them, though I have no idea if that would work). Does NTFS-3G save the creation date of files on Linux? If so, how do I access it?

Reading this thread, the OP links documentation on NTFS that provides a shell script for finding the creation date. I modified it in an attempt to get the seconds from the hex value, but I believe that I am doing something wrong:

CRTIME=`getfattr -h -e hex -n system.ntfs_times $1 | \
    grep '=' | sed -e 's/^.*=\(0x................\).*$/\1/'`
SECONDS=$(($CRTIME / 10000000))
echo `date --date=$SECONDS`
share|improve this question
up vote 5 down vote accepted

From http://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/,

An NTFS file is qualified by a set of four time stamps “representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”, though UTC has not been defined for years before 1961 because of unknown variations of the earth rotation.

You'll find even more information in there including:

Newer versions of ntfs-3g expose a ntfs.ntfs_crtime and ntfs.ntfs_crtime_be attribute.


getfattr --only-values -n system.ntfs_crtime_be /some/file |
  perl -MPOSIX -0777 -ne '$t = unpack("Q>");
  print ctime $t/10000000-11644473600'

See also:

ntfsinfo -F /file/in/ntfs /dev/fs-device

With older ntfs-3g, this should work:

getfattr --only-values -n system.ntfs_times /some/file |
  perl -MPOSIX -0777 -ne 'print ctime unpack(Q)/10000000-11644473600'

Or with GNU tools and sub-second precision:

date '+%F %T.%N' -d "@$({ echo 7k
  getfattr --only-values -n system.ntfs_times /some/file |
    od -A n -N 8 -vt u8; echo '10000000/ 11644473600-p'; } |dc)"
share|improve this answer
Ah, I actually was subtracting 11,644,473,600 after I posted this question, but because I had the 100-nanosecond intervals wrong it was resulting in an invalid result. I'll test this when I get back to my box. – NobleUplift Aug 19 '13 at 21:25
It worked! Thanks. How does unpack("Q>") work? I read the Perl doc and I don't entirely understand it. – NobleUplift Aug 20 '13 at 2:34
@NobleUplift, unpacks a big endian (>) [Q]uad (64bit integer) – Stéphane Chazelas Aug 20 '13 at 5:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.