6

Using ext4 filesystem I was able to read out the creation time of a file using the approach here. As a result I am indeed provided with a table featuring the crtime (creation time) of the inode(respective file) in question.

What confuses me and to which I could not find an answer in the man debugfs is why it shows me 2 lines with crtime, moreover not even being the same time.

This is the output I get

[user ~] $ sudo debugfs -R "stat <274742>" /dev/sda2
debugfs 1.43.1 (08-Jun-2016)
Inode: 274742   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 3666549610    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 0
File ACL: 0    Directory ACL: 0
Links: 0   Blockcount: 0
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
 atime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
 mtime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
crtime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
crtime: 0x57b4c632:(1e30ee34) -- Wed Aug 17 22:16:50 2016
Size of extra inode fields: 32

Also note that the second (and not realy correct) crtime is in brackets and equals the mtime, since I saved to the file obviously twice.

  • 3
    Looking at the source code, it looks like a copy/paste error. The second crtime ought to be dtime – Mark Plotnick Aug 17 '16 at 21:02
  • @MarkPlotnick Hmm on CentOS 7 it correctly reports dtime; maybe that's a RedHat patch :-) – Stephen Harris Aug 18 '16 at 0:58
  • @MarkPlotnick yes that was it. Liked the linked the source code reference. if you moved that to an answer it was possible to resolve this question more obviously.. – humanityANDpeace Aug 18 '16 at 6:51
  • @StephenHarris CentOS 7 has a version of e2fsprogs (1.42.9) that preceeds the change that introduced the error – Mark Plotnick Aug 18 '16 at 16:18
6

This is the result of an editing error in the e2fsprogs patch debugfs: add support to properly set and display extended timestamps. The second crtime: line ought to be dtime:.

if (inode->i_dtime)
  fprintf(out, "%scrtime: 0x%08x:(%08x) -- %s", prefix,
          large_inode->i_dtime, large_inode->i_ctime_extra,
          inode_time_to_string(inode->i_dtime,
          large_inode->i_ctime_extra));

I submitted a bug report.

  • great to hear that there was a bug report filed. what keeps me yet a little suprised is that dtime would be (delete) time appeared. Seems that my program (geany editor) did indeed delete and replace the file, so that when I checked with the old inode I was shown the dtime (confusingly mislabeled crtime) – humanityANDpeace Aug 18 '16 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.