I created an NTFS logical volume on my Linux system for Windows file storage because I want to retain the creation date of my files (I would probably zip them into an archive and then unzip them, though I have no idea if that would work). Does NTFS-3G save the creation date of files on Linux? If so, how do I access it?

Reading this thread, the OP links documentation on NTFS that provides a shell script for finding the creation date. I modified it in an attempt to get the seconds from the hex value, but I believe that I am doing something wrong:

CRTIME=`getfattr -h -e hex -n system.ntfs_times $1 | \
    grep '=' | sed -e 's/^.*=\(0x................\).*$/\1/'`
SECONDS=$(($CRTIME / 10000000))
echo `date --date=$SECONDS`

From https://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/#filetimes,

An NTFS file is qualified by a set of four time stamps “representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”, though UTC has not been defined for years before 1961 because of unknown variations of the earth rotation.

You'll find even more information in there including:

Newer versions of ntfs-3g expose a ntfs.ntfs_crtime and ntfs.ntfs_crtime_be attribute.


getfattr --only-values -n system.ntfs_crtime_be /some/file |
  perl -MPOSIX -0777 -ne '$t = unpack("Q>");
  print ctime $t/10000000-11644473600'

See also:

ntfsinfo -F /file/in/ntfs /dev/fs-device

With older ntfs-3g, this should work:

getfattr --only-values -n system.ntfs_times /some/file |
  perl -MPOSIX -0777 -ne 'print ctime unpack(Q)/10000000-11644473600'

Or with GNU tools and sub-second precision:

date '+%F %T.%N' -d "@$({ echo 7k
  getfattr --only-values -n system.ntfs_times /some/file |
    od -A n -N 8 -vt u8; echo '10000000/ 11644473600-p'; } |dc)"
  • Ah, I actually was subtracting 11,644,473,600 after I posted this question, but because I had the 100-nanosecond intervals wrong it was resulting in an invalid result. I'll test this when I get back to my box. – NobleUplift Aug 19 '13 at 21:25
  • It worked! Thanks. How does unpack("Q>") work? I read the Perl doc and I don't entirely understand it. – NobleUplift Aug 20 '13 at 2:34
  • 1
    @NobleUplift, unpacks a big endian (>) [Q]uad (64bit integer) – Stéphane Chazelas Aug 20 '13 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.