1

I am seeking a method of getting the crtime of a file in hexadecimal or decimal in unix epoch seconds instead of in a date and clock format and with no additional output.

This command adds additional text at the top of the output ( such as "debugfs 1.42.12 (29-Aug-2014)") that's impossible to remove with grep, sed, etc.

debugfs -R 'stat <7473635>' /dev/sda7 | grep ctime

This command gives the modification time in unix epoch seconds.

date -r default.txt +%s

Additionally all the other posts I've looked at that do get crtime of files get it in a date and clock opposed to unix epoch time. In conclusion how do I get only the creation time of a file in an ext4 fs in unix epoch seconds.

1
  • If you have a method that gets it in an unambiguous calendar output (e.g. YYYY-MM-DDTHH:MM:SS or similar), date can convert it to epoch time for you (using date -d "<calendar date>" +%s or so).
    – Tom Hunt
    Oct 19, 2015 at 21:42

1 Answer 1

0

You can use grep with PCRE (-P) to extract the desired portion and use it as input for date:

date --date="$(sudo debugfs .... |& grep -Po '^crtime.*-\s\K.*$')" '+%s'

Or

date --date="$(sudo debugfs .... 2>/dev/null | grep -Po '^crtime.*-\s\K.*$')" '+%s'

For example:

$ date --date="$(sudo debugfs -R 'stat <677051>' /dev/sda3 |& grep -Po '^crtime.*-\s\K.*$')" '+%s'
1442488264

You can also use sed:

date --date="$(sudo debugfs .... |& sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'

Or

date --date="$(sudo debugfs .... 2>/dev/null | sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'

For example:

$ date --date="$(sudo debugfs -R 'stat <677051>' /dev/sda3 |& sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'
1442488264

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .