How do I get the creation date of a file on an NTFS logical volume?

Question

I created an NTFS logical volume on my Linux system for Windows file storage because I want to retain the creation date of my files (I would probably zip them into an archive and then unzip them, though I have no idea if that would work). Does NTFS-3G save the creation date of files on Linux? If so, how do I access it?

Reading this thread, the OP links documentation on NTFS that provides a shell script for finding the creation date. I modified it in an attempt to get the seconds from the hex value, but I believe that I am doing something wrong:

#!/bin/sh
CRTIME=`getfattr -h -e hex -n system.ntfs_times $1 | \
    grep '=' | sed -e 's/^.*=\(0x................\).*$/\1/'`
SECONDS=$(($CRTIME / 10000000))
echo `date --date=$SECONDS`

Answer 1

From https://github.com/tuxera/ntfs-3g/wiki/Using-Extended-Attributes#file-times,

An NTFS file is qualified by a set of four time stamps “representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”, though UTC has not been defined for years before 1961 because of unknown variations of the earth rotation.

You'll find even more information in there including:

Newer versions of ntfs-3g expose a ntfs.ntfs_crtime and ntfs.ntfs_crtime_be attribute.

So:

getfattr --only-values -n system.ntfs_crtime_be /some/file |
  perl -MPOSIX -0777 -ne '$t = unpack("Q>");
  print ctime $t/10000000-11644473600'

See also:

ntfsinfo -F /file/in/ntfs /dev/fs-device

With older ntfs-3g, this should work:

getfattr --only-values -n system.ntfs_times /some/file |
  perl -MPOSIX -0777 -ne 'print ctime unpack(Q)/10000000-11644473600'

Or with GNU coreutils and sub-second precision:

date '+%F %T.%N' -d "@$({ echo 7k
  getfattr --only-values -n system.ntfs_times /some/file |
    od -A n -N 8 -vt u8; echo '10000000/ 11644473600-p'; } |dc)"