In my first question: How do I get the creation date of a file on an NTFS logical volume, I asked how to get the "Date created" field in NTFS-3G. Now, that I know I can get the "Date created", I have started adding files onto my NTFS-3G partition and would like to set the "Date created" of each file to its "Date modified" value.

Since this needs to be done on a whole repository of files, I would like to recursively apply it to a single directory on down. If I know how to do this for a single file, I could probably do the recursion myself, but if you want to add that in I would be more than happy.

1 Answer 1


The system.ntfs_times extended attribute contains 32 bytes that consist of the btime, mtime, atime, ctime as 64bit integers.

You can list them with for instance:

getfattr --only-values -n system.ntfs_times -- "$file" |
  perl -MPOSIX -0777 -ne 'print ctime $_/10000000-11644473600 for unpack("Q4",$_)'

So you can just copy the second integer to the first with something like:

getfattr -n system.ntfs_times -e hex -- "$file" |
  sed '2s/0x.\{16\}\(.\{16\}\)/0x\1\1/' |
  setfattr --restore=-
  • This is awesome. I don't have a Linux box that I could test this one (with easy access to NTFS), but I might be able to add an NTFS partition to one of my current boxes to play around with it. Commented Jul 28, 2016 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .