I am trying to find the creation date on an ext2 file system. I seem to get a current date using dumpe2fs.
The problem is that the original ext2 superblock specification does not contain such information, though it seems like there might be an extension to the original fields (something about after byte 264).
In fact using hexdump on the superblock (hexdump -s 1024 -n 1024 -C /dev/vdb) I can find 4 bytes starting from byte 265 that containg a hex number which contain in little endian the unix time of the file system creation. Any information on how, why and under what circumstances that it there?
Thanks in advance
-
Just speculating: That is far enough into the image: is the maybe the ctime of the root directory of said filesystem?– Marcus MüllerCommented Jan 12, 2023 at 18:17
-
1It's well within the superblock's boundaries (264 bytes after its begging, the block size is 1K), so how could that be the case?– Panagiotis StefanisCommented Jan 12, 2023 at 19:11
-
Please update your question with A/ the Minor portion of version (2 bytes found at offset 62) B/ the Major portion of version (4 bytes found at offset 76) C/ the Operating system ID from which the filesystem on this volume was created (4 bytes found at offset 72)– MC68020Commented Jan 12, 2023 at 20:20
Add a comment
|
1 Answer
You are correct writing that the original ext2 superblock specification does not make provision for storing the file system creation date.
But leaves 788 bytes Unused starting from offset 236.
Unused meaning free for use by the programs creating/using the filesystem.
Ext4 contrarily makes provision for storing when the filesystem was created, in seconds since the epoch, s_mkfs_time, at offset 0x108 of an ext4 type superblock… that is precisely… 264 decimal.
For easing the coding of tools working more or less generally with all the ext family of filesystems, some utilities dedicated to filesystem creation might fill some of the unused 788 bytes of an ext2 superblock with ext4-like infos.
This being for example the case of the busybox mkfs_ext2 utility. cf line 522 :
STORE_LE(sb->s_mkfs_time, timestamp);