0

Using debugfs -R 'stat <inode_nr> ' /dev/sda1 returns a result where there is a field crtime which i believe represents the creation date of a file pointed to by inode numbered inode_nr. I use this on an ext4 fs.

I know that the inode stores access_time, modification_time and change_time but not birth of a file

So my question is where is the creation time stored or how does the debugfs command retrieve it?

migrated from stackoverflow.com Oct 22 '18 at 9:47

This question came from our site for professional and enthusiast programmers.

2

If the filesystem records file creation time (Not all do), it's stored in the inode along with the rest of the file metadata like modification and change times. It can be retrieved with the fairly recently added statx(2) system call in the stx_btime field of the struct statx that it populates. Note that there's no easy to use wrapper for it provided by glibc; you have to make the syscall directly.

debugfs probably examines the inode structures directly, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.