The successful command from which I started:

getfattr -n system.ntfs_times /media/hdd/oldfolder/


getfattr: Removing leading '/' from absolute path names
# file: media/hdd/oldfolder/

but if i try

getfattr -d /media/hdd/oldfolder/ or getfattr -d -e text /media/hdd/oldfolder/ or hex or base64 as values of param -e i get nothing.

Why is that? I thought -d dump ALL attributes not NO attributes :)


3 Answers 3


To truly report all attributes you can use the argument -dm-, which represents the arguments -d and -m -.

For example I launched Chromium, I went to https://bugsfiles.kde.org/attachment.cgi?id=86198, that action started to download a file and I named it "my_downloaded_file".

Then I executed getfattr -m- my_downloaded_file and it showed:

# file: my_downloaded_file

although more information was shown executing getfattr -dm- my_downloaded_file:

# file: my_downloaded_file



I assume you're using the ntfs-3g linux driver. That driver creates some virtual xattrs, of which system.ntfs_times is one. When listing xattrs, the driver does not list these virtual xattrs, but I don't see a reason why it couldn't. Using the xattr mapping feature, you can get the xattrs in the system namespace to be mapped into the user namespace and they will then be listed. A list of these virtual xattrs can be found in the documentation and the source.


The man page of getfattr command is not clear on this, but to really see all output, use the following switch:

getfattr -m - -- "$your_path_or_file_name"

From man page:

-m pattern, --match=pattern
           Only include attributes with names matching the regular expression pattern.  The default value for pattern
           is "^user\\.", which includes all the attributes in the user namespace.  Specify  "-"  for  including  all
           attributes.  Refer to attr(5) for a more detailed discussion of namespaces.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .