Using debugfs -R 'stat <inode_nr> ' /dev/sda1 returns a result where there is a field crtime which i believe represents the creation date of a file pointed to by inode numbered inode_nr. I use this on an ext4 fs.

I know that the inode stores access_time, modification_time and change_time but not birth of a file

So my question is where is the creation time stored or how does the debugfs command retrieve it?


1 Answer 1


If the filesystem records file creation time (Not all do), it's stored in the inode along with the rest of the file metadata like modification and change times. It can be retrieved with the fairly recently added statx(2) system call in the stx_btime field of the struct statx that it populates. Note that there's no easy to use wrapper for it provided by glibc; you have to make the syscall directly.

debugfs probably examines the inode structures directly, though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .