linux-ext4 - Re: birth time of a file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Sep 2014 09:08:09 +0200
From:	Andreas Dilger <adilger@...ger.ca>
To:	Christian Kujau <lists@...dbynature.de>
Cc:	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Re: birth time of a file

It looks like your filesystem is formatted with 128-byte inodes
(i.e. ext3) instead of 256-byte inodes (i.e. ext4). The i_crtime is stored
in this extended space of the inode.  You could verify this with

   dumpe2fs -h /dev/loop0

and look for the "Inode size" field. 

This is a format time option. What is strange is that you have specified mkfs.ext4, so this should be selected automatically. It may be that with very small devices (e.g. floppy size) it defaults to 128-byte inodes. 

Cheers, Andreas

> On Sep 25, 2014, at 8:23, Christian Kujau <lists@...dbynature.de> wrote:
> 
> Hi,
> 
> I want to find out the "creation time" or "birth time" of a file. I know, 
> this comes up every now and then but I could not find any recent or 
> reliable information, just random posting on the interwebs. Here[0] it is 
> suggested that coreutils stat(1) cannot display "birth time", although a 
> commit[1] from 2010 states that birthtime is now supported. But even if 
> stat(1) cannot display it, debugfs should be able to, but not here:
> 
> # mkfs.ext4 /dev/loop0
> # mount -t ext4 /dev/loop0 /mnt/disk/
> # mount | tail -1
> /dev/loop0 on /mnt/disk1 type ext4 (rw,relatime,data=ordered)
> # touch /mnt/disk/foo
> # debugfs -R 'stat foo' /dev/loop0
> debugfs 1.42.12 (29-Aug-2014)
> Inode: 12   Type: regular    Mode:  0600   Flags: 0x80000
> Generation: 3547819027    Version: 0x00000001
> User:     0   Group:     0   Size: 0
> File ACL: 0    Directory ACL: 0
> Links: 1   Blockcount: 0
> Fragment:  Address: 0    Number: 0    Size: 0
> ctime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> atime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> mtime: 0x5423a873 -- Wed Sep 24 22:30:27 2014
> EXTENTS:
> 
> 
> Now, fs/ext4/ext4.h defines i_crtime and it's referenced in ialloc.c and 
> inode.c, so it seems to be used - but why can't debugfs display it? I 
> tested this with 3.14, 3.17-rc6 and 3.16 kernels, debugfs just would 
> not display "crtime".
> 
> Thanks,
> Christian.
> 
> [0] https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4 
> [1] http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=abe5c1f9
> -- 
> BOFH excuse #408:
> 
> Computers under water due to SYN flooding.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html