linux-ext4 - Re: birth time of a file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.19.4.1409250223520.9897@trent.utfs.org>
Date:	Thu, 25 Sep 2014 02:40:56 -0700 (PDT)
From:	Christian Kujau <lists@...dbynature.de>
To:	Andreas Dilger <adilger@...ger.ca>
cc:	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Re: birth time of a file

On Thu, 25 Sep 2014 at 09:08, Andreas Dilger wrote:
> It looks like your filesystem is formatted with 128-byte inodes
> (i.e. ext3) instead of 256-byte inodes (i.e. ext4). The i_crtime is stored
> in this extended space of the inode.  You could verify this with

Bingo! Thanks, that was the problem. I used a small (less than 512MB) test 
filesystem and inode size was indeed 128 byte. When I ran mkfs.ext4 on a 
512 MB (and larger) device, 256 byte inodes were created and then crtime 
was indeed visible with debugfs. Or I could have used -I to force larger 
inodes.

Thanks for the hint!
Christian. 

>    dumpe2fs -h /dev/loop0
> 
> and look for the "Inode size" field. 
> 
> This is a format time option. What is strange is that you have specified mkfs.ext4, so
> this should be selected automatically. It may be that with very small 
> devices (e.g. floppy size) it defaults to 128-byte inodes. 

-- 
BOFH excuse #124:

user to computer ration too low.
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html