linux-ext4 - birth time of a file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Sep 2014 23:23:24 -0700 (PDT)
From:	Christian Kujau <lists@...dbynature.de>
To:	linux-ext4@...r.kernel.org
Subject: birth time of a file

Hi,

I want to find out the "creation time" or "birth time" of a file. I know, 
this comes up every now and then but I could not find any recent or 
reliable information, just random posting on the interwebs. Here[0] it is 
suggested that coreutils stat(1) cannot display "birth time", although a 
commit[1] from 2010 states that birthtime is now supported. But even if 
stat(1) cannot display it, debugfs should be able to, but not here:

# mkfs.ext4 /dev/loop0
# mount -t ext4 /dev/loop0 /mnt/disk/
# mount | tail -1
/dev/loop0 on /mnt/disk1 type ext4 (rw,relatime,data=ordered)
# touch /mnt/disk/foo
# debugfs -R 'stat foo' /dev/loop0
debugfs 1.42.12 (29-Aug-2014)
Inode: 12   Type: regular    Mode:  0600   Flags: 0x80000
Generation: 3547819027    Version: 0x00000001
User:     0   Group:     0   Size: 0
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 0
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
atime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
mtime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
EXTENTS:

Now, fs/ext4/ext4.h defines i_crtime and it's referenced in ialloc.c and 
inode.c, so it seems to be used - but why can't debugfs display it? I 
tested this with 3.14, 3.17-rc6 and 3.16 kernels, debugfs just would 
not display "crtime".

Thanks,
Christian.

[0] https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4 
[1] http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=abe5c1f9
-- 
BOFH excuse #408:

Computers under water due to SYN flooding.
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html