6

Using ext4 filesystem I was able to read out the creation time of a file using the approach here. As a result I am indeed provided with a table featuring the crtime (creation time) of the inode(respective file) in question.

What confuses me and to which I could not find an answer in the man debugfs is why it shows me 2 lines with crtime, moreover not even being the same time.

This is the output I get

[user ~] $ sudo debugfs -R "stat <274742>" /dev/sda2
debugfs 1.43.1 (08-Jun-2016)
Inode: 274742   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 3666549610    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 0
File ACL: 0    Directory ACL: 0
Links: 0   Blockcount: 0
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
 atime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
 mtime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
crtime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
crtime: 0x57b4c632:(1e30ee34) -- Wed Aug 17 22:16:50 2016
Size of extra inode fields: 32

Also note that the second (and not realy correct) crtime is in brackets and equals the mtime, since I saved to the file obviously twice.

4
  • 3
    Looking at the source code, it looks like a copy/paste error. The second crtime ought to be dtime Aug 17, 2016 at 21:02
  • @MarkPlotnick Hmm on CentOS 7 it correctly reports dtime; maybe that's a RedHat patch :-) Aug 18, 2016 at 0:58
  • @MarkPlotnick yes that was it. Liked the linked the source code reference. if you moved that to an answer it was possible to resolve this question more obviously.. Aug 18, 2016 at 6:51
  • @StephenHarris CentOS 7 has a version of e2fsprogs (1.42.9) that preceeds the change that introduced the error Aug 18, 2016 at 16:18

1 Answer 1

6

This is the result of an editing error in the e2fsprogs patch debugfs: add support to properly set and display extended timestamps. The second crtime: line ought to be dtime:.

if (inode->i_dtime)
  fprintf(out, "%scrtime: 0x%08x:(%08x) -- %s", prefix,
          large_inode->i_dtime, large_inode->i_ctime_extra,
          inode_time_to_string(inode->i_dtime,
          large_inode->i_ctime_extra));

I submitted a bug report.

1
  • great to hear that there was a bug report filed. what keeps me yet a little suprised is that dtime would be (delete) time appeared. Seems that my program (geany editor) did indeed delete and replace the file, so that when I checked with the old inode I was shown the dtime (confusingly mislabeled crtime) Aug 18, 2016 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .