I have a linux server which captures network pcap files and save it to a CIFS shared drive. I have found out that the creation time and modified time of the pcap files seems to be the same. Which shouldn't be, as each file has 10 seconds of data so the creation time should be 10 seconds older than the modified time. If I'm correctly understanding the time attributes. I need this difference as the software with which I extract the files from the shared drive fixes the time span with start time as creation time of first file and end time as "last write /modified time" of the last file. Is this happening because of a linux bug? I know there will be a difference in the creation time and modified time as I have seen it before on the system few months ago.
asked Jul 3, 2014 at 13:43
Add a comment
|
2 Answers
Linux doesn't have an easily accessible file creation timestamp (but see Stéphane's comment below). Running stat on a file I've just created shows a Access, Modify and Change timestamp - but no creation.
I'm guessing that maybe the CIFS share you viewed a few months ago was not created by a Linux system? Maybe it was a Windows system shared by CIFS?
answered Jul 3, 2014 at 14:26
-
Linux does have creation time but it's not easily accessible. Commented Jul 3, 2014 at 14:32
For the record it's possible to get the file creation timestamp of a file (along with the rest) on a SAMBA/SMB/CIFS share with smbinfo from cifs-utils:
smbinfo filebasicinfo /mnt/share/folder/file
Creation Time Fri Jun 25 13:40:25 2021
Last Access Time Fri Jan 6 07:34:38 2023
Last Write Time Fri Jan 6 07:35:18 2023
Last Change Time Fri Jan 6 12:29:21 2023
File Attributes 0x00000010:
