From Linux, if I alter files on an NTFS external HD so that I get some specific values for mtime, atime and ctime (readable with the stat command, and with ctime = mtime because one cannot change access permissions of files on NTFS from Linux - I think) and if I then connect the same external HD on a Windows 7 system, I see that Date modified = mtime (as expected) but I also get Date created = atime.

How comes atime takes the placeholder associated with the NTFS CTime timestamp, and is there a way to avoid this behavior, for example would using the noatime option on NTFS volumes be a proper solution? My goal is to be able to work from both Windows and Linux on this same external HD without mingling too much the timestamps.


After re-investigating the issue, it turns out that the problem is not present in the end. I must have been confused at the time I asked the question. I still leave the question as it has generated some comments and an answer.


1 Answer 1


This was too big to write as a comment, but I think it can help.

Well if you want to avoid this behavior, you can do something like this:

 $current_ctime=$(getfattr -n system.ntfs_crtime_be -e hex yourfile | grep system.ntfs_crtime_be | cut -d= -f2) 

Then after the changes restore the current_ctime using:

setfattr -n system.ntfs_crtime_be -v $current_ctime yourfile 

For multiple files, you can store for example all the ctimes using a for loop and restoring them in the same way for each file.

Not very beautiful but it works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .