I created an NTFS logical volume on my Linux system for Windows file storage because I want to retain the creation date of my files (I would probably zip them into an archive and then unzip them, though I have no idea if that would work). Does NTFS-3G save the creation date of files on Linux? If so, how do I access it?

Reading this thread, the OP links documentation on NTFS that provides a shell script for finding the creation date. I modified it in an attempt to get the seconds from the hex value, but I believe that I am doing something wrong:

CRTIME=`getfattr -h -e hex -n system.ntfs_times $1 | \
    grep '=' | sed -e 's/^.*=\(0x................\).*$/\1/'`
SECONDS=$(($CRTIME / 10000000))
echo `date --date=$SECONDS`

1 Answer 1


From https://github.com/tuxera/ntfs-3g/wiki/Using-Extended-Attributes#file-times,

An NTFS file is qualified by a set of four time stamps “representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”, though UTC has not been defined for years before 1961 because of unknown variations of the earth rotation.

You'll find even more information in there including:

Newer versions of ntfs-3g expose a ntfs.ntfs_crtime and ntfs.ntfs_crtime_be attribute.


getfattr --only-values -n system.ntfs_crtime_be /some/file |
  perl -MPOSIX -0777 -ne '$t = unpack("Q>");
  print ctime $t/10000000-11644473600'

See also:

ntfsinfo -F /file/in/ntfs /dev/fs-device

With older ntfs-3g, this should work:

getfattr --only-values -n system.ntfs_times /some/file |
  perl -MPOSIX -0777 -ne 'print ctime unpack(Q)/10000000-11644473600'

Or with GNU tools and sub-second precision:

date '+%F %T.%N' -d "@$({ echo 7k
  getfattr --only-values -n system.ntfs_times /some/file |
    od -A n -N 8 -vt u8; echo '10000000/ 11644473600-p'; } |dc)"
  • Ah, I actually was subtracting 11,644,473,600 after I posted this question, but because I had the 100-nanosecond intervals wrong it was resulting in an invalid result. I'll test this when I get back to my box. Aug 19, 2013 at 21:25
  • It worked! Thanks. How does unpack("Q>") work? I read the Perl doc and I don't entirely understand it. Aug 20, 2013 at 2:34
  • 1
    @NobleUplift, unpacks a big endian (>) [Q]uad (64bit integer) Aug 20, 2013 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .