In my first question: How do I get the creation date of a file on an NTFS logical volume, I asked how to get the "Date created" field in NTFS-3G. Now, that I know I can get the "Date created", I have started adding files onto my NTFS-3G partition and would like to set the "Date created" of each file to its "Date modified" value.

Since this needs to be done on a whole repository of files, I would like to recursively apply it to a single directory on down. If I know how to do this for a single file, I could probably do the recursion myself, but if you want to add that in I would be more than happy.


The system.ntfs_times extended attribute contains 32 bytes that consist of the btime, mtime, atime, ctime as 64bit integers.

You can list them with for instance:

getfattr --only-values -n system.ntfs_times -- "$file" |
  perl -MPOSIX -0777 -ne 'print ctime $_/10000000-11644473600 for unpack("Q4",$_)'

So you can just copy the second integer to the first with something like:

getfattr -n system.ntfs_times -e hex -- "$file" |
  sed '2s/0x.\{16\}\(.\{16\}\)/0x\1\1/' |
  setfattr --restore=-
  • This is awesome. I don't have a Linux box that I could test this one (with easy access to NTFS), but I might be able to add an NTFS partition to one of my current boxes to play around with it. – NobleUplift Jul 28 '16 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.