6

Using ext4 filesystem I was able to read out the creation time of a file using the approach here. As a result I am indeed provided with a table featuring the crtime (creation time) of the inode(respective file) in question.

What confuses me and to which I could not find an answer in the man debugfs is why it shows me 2 lines with crtime, moreover not even being the same time.

This is the output I get

[user ~] $ sudo debugfs -R "stat <274742>" /dev/sda2
debugfs 1.43.1 (08-Jun-2016)
Inode: 274742   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 3666549610    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 0
File ACL: 0    Directory ACL: 0
Links: 0   Blockcount: 0
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
 atime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
 mtime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
crtime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
crtime: 0x57b4c632:(1e30ee34) -- Wed Aug 17 22:16:50 2016
Size of extra inode fields: 32

Also note that the second (and not realy correct) crtime is in brackets and equals the mtime, since I saved to the file obviously twice.

Improve this question
4
  • 3
    Looking at the source code, it looks like a copy/paste error. The second crtime ought to be dtime
    – Mark Plotnick
    Aug 17, 2016 at 21:02
  • @MarkPlotnick Hmm on CentOS 7 it correctly reports dtime; maybe that's a RedHat patch :-)
    – Stephen Harris
    Aug 18, 2016 at 0:58
  • @MarkPlotnick yes that was it. Liked the linked the source code reference. if you moved that to an answer it was possible to resolve this question more obviously..
    – humanityANDpeace
    Aug 18, 2016 at 6:51
  • @StephenHarris CentOS 7 has a version of e2fsprogs (1.42.9) that preceeds the change that introduced the error
    – Mark Plotnick
    Aug 18, 2016 at 16:18

1 Answer 1

Reset to default
6

This is the result of an editing error in the e2fsprogs patch debugfs: add support to properly set and display extended timestamps. The second crtime: line ought to be dtime:.

if (inode->i_dtime)
  fprintf(out, "%scrtime: 0x%08x:(%08x) -- %s", prefix,
          large_inode->i_dtime, large_inode->i_ctime_extra,
          inode_time_to_string(inode->i_dtime,
          large_inode->i_ctime_extra));

I submitted a bug report.

Improve this answer
1
  • great to hear that there was a bug report filed. what keeps me yet a little suprised is that dtime would be (delete) time appeared. Seems that my program (geany editor) did indeed delete and replace the file, so that when I checked with the old inode I was shown the dtime (confusingly mislabeled crtime)
    – humanityANDpeace
    Aug 18, 2016 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .