I am seeking a method of getting the crtime of a file in hexadecimal or decimal in unix epoch seconds instead of in a date and clock format and with no additional output.

This command adds additional text at the top of the output ( such as "debugfs 1.42.12 (29-Aug-2014)") that's impossible to remove with grep, sed, etc.

debugfs -R 'stat <7473635>' /dev/sda7 | grep ctime

This command gives the modification time in unix epoch seconds.

date -r default.txt +%s

Additionally all the other posts I've looked at that do get crtime of files get it in a date and clock opposed to unix epoch time. In conclusion how do I get only the creation time of a file in an ext4 fs in unix epoch seconds.

  • If you have a method that gets it in an unambiguous calendar output (e.g. YYYY-MM-DDTHH:MM:SS or similar), date can convert it to epoch time for you (using date -d "<calendar date>" +%s or so). – Tom Hunt Oct 19 '15 at 21:42

You can use grep with PCRE (-P) to extract the desired portion and use it as input for date:

date --date="$(sudo debugfs .... |& grep -Po '^crtime.*-\s\K.*$')" '+%s'


date --date="$(sudo debugfs .... 2>/dev/null | grep -Po '^crtime.*-\s\K.*$')" '+%s'

For example:

$ date --date="$(sudo debugfs -R 'stat <677051>' /dev/sda3 |& grep -Po '^crtime.*-\s\K.*$')" '+%s'

You can also use sed:

date --date="$(sudo debugfs .... |& sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'


date --date="$(sudo debugfs .... 2>/dev/null | sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'

For example:

$ date --date="$(sudo debugfs -R 'stat <677051>' /dev/sda3 |& sed -n 's/^crtime.*- \(.*\)$/\1/p')" '+%s'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.