Hi,
I want to find out the "creation time" or "birth time" of a file. I know,
this comes up every now and then but I could not find any recent or
reliable information, just random posting on the interwebs. Here[0] it is
suggested that coreutils stat(1) cannot display "birth time", although a
commit[1] from 2010 states that birthtime is now supported. But even if
stat(1) cannot display it, debugfs should be able to, but not here:
# mkfs.ext4 /dev/loop0
# mount -t ext4 /dev/loop0 /mnt/disk/
# mount | tail -1
/dev/loop0 on /mnt/disk1 type ext4 (rw,relatime,data=ordered)
# touch /mnt/disk/foo
# debugfs -R 'stat foo' /dev/loop0
debugfs 1.42.12 (29-Aug-2014)
Inode: 12 Type: regular Mode: 0600 Flags: 0x80000
Generation: 3547819027 Version: 0x00000001
User: 0 Group: 0 Size: 0
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 0
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
atime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
mtime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
EXTENTS:
Now, fs/ext4/ext4.h defines i_crtime and it's referenced in ialloc.c and
inode.c, so it seems to be used - but why can't debugfs display it? I
tested this with 3.14, 3.17-rc6 and 3.16 kernels, debugfs just would
not display "crtime".
Thanks,
Christian.
[0] https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4
[1] http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=abe5c1f9
--
BOFH excuse #408:
Computers under water due to SYN flooding.
It looks like your filesystem is formatted with 128-byte inodes
(i.e. ext3) instead of 256-byte inodes (i.e. ext4). The i_crtime is stored
in this extended space of the inode. You could verify this with
dumpe2fs -h /dev/loop0
and look for the "Inode size" field.
This is a format time option. What is strange is that you have specified mkfs.ext4, so this should be selected automatically. It may be that with very small devices (e.g. floppy size) it defaults to 128-byte inodes.
Cheers, Andreas
> On Sep 25, 2014, at 8:23, Christian Kujau <[email protected]> wrote:
>
> Hi,
>
> I want to find out the "creation time" or "birth time" of a file. I know,
> this comes up every now and then but I could not find any recent or
> reliable information, just random posting on the interwebs. Here[0] it is
> suggested that coreutils stat(1) cannot display "birth time", although a
> commit[1] from 2010 states that birthtime is now supported. But even if
> stat(1) cannot display it, debugfs should be able to, but not here:
>
> # mkfs.ext4 /dev/loop0
> # mount -t ext4 /dev/loop0 /mnt/disk/
> # mount | tail -1
> /dev/loop0 on /mnt/disk1 type ext4 (rw,relatime,data=ordered)
> # touch /mnt/disk/foo
> # debugfs -R 'stat foo' /dev/loop0
> debugfs 1.42.12 (29-Aug-2014)
> Inode: 12 Type: regular Mode: 0600 Flags: 0x80000
> Generation: 3547819027 Version: 0x00000001
> User: 0 Group: 0 Size: 0
> File ACL: 0 Directory ACL: 0
> Links: 1 Blockcount: 0
> Fragment: Address: 0 Number: 0 Size: 0
> ctime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> atime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> mtime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> EXTENTS:
>
>
> Now, fs/ext4/ext4.h defines i_crtime and it's referenced in ialloc.c and
> inode.c, so it seems to be used - but why can't debugfs display it? I
> tested this with 3.14, 3.17-rc6 and 3.16 kernels, debugfs just would
> not display "crtime".
>
> Thanks,
> Christian.
>
> [0] https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4
> [1] http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=abe5c1f9
> --
> BOFH excuse #408:
>
> Computers under water due to SYN flooding.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, 25 Sep 2014 at 09:08, Andreas Dilger wrote:
> It looks like your filesystem is formatted with 128-byte inodes
> (i.e. ext3) instead of 256-byte inodes (i.e. ext4). The i_crtime is stored
> in this extended space of the inode. You could verify this with
Bingo! Thanks, that was the problem. I used a small (less than 512MB) test
filesystem and inode size was indeed 128 byte. When I ran mkfs.ext4 on a
512 MB (and larger) device, 256 byte inodes were created and then crtime
was indeed visible with debugfs. Or I could have used -I to force larger
inodes.
Thanks for the hint!
Christian.
> dumpe2fs -h /dev/loop0
>
> and look for the "Inode size" field.
>
> This is a format time option. What is strange is that you have specified mkfs.ext4, so
> this should be selected automatically. It may be that with very small
> devices (e.g. floppy size) it defaults to 128-byte inodes.
--
BOFH excuse #124:
user to computer ration too low.