Creation time in UniX? Yes - in ext4

The ext4 file system has now been available for a while, but so far Ubuntu is the only distribution installing it by default.

There are significant differences between ext4 and its predecessors, and amongst them is extent mapping (instead of the traditional indirect block mapping), the new 1 nanosecond date resolution capability, date limit pushed back till 25/04/2514, and for the first time in UNIX i-node that stores five file timestamps (i-node width defaults to 256 bytes in ext4).

In addition to the traditional atime (a=access), mtime (m=modification) and ctime (c=change of i-node), in ext4 we now also have crtime (cr=creation) and dtime (d=deletion).

It's this creation time that many people insisted on having... So we now have it. There is one problem, though. Standard Linux tools can't yet deal with this sophistication!

Normally, we would use tools like stat or find to read file attributes from their i-nodes, but at the moment, they are not extracting any more information from ext4 than from ext2 or ext3.

This is where debugfs can help. First, check which partitions are formatted with ext4:

# mount | grep ext4

/dev/sda1 on / type ext4 (rw,errors=remount-ro)

Here, the root file system is ext4. To see all know timestamps on a file in this file system (for example, for /etc/hosts file):

# debugfs -R 'stat /etc/hosts' /dev/sda1

Inode: 133370 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1995841318 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 250
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
atime: 0x4c3da303:c11dd858 -- Wed Jul 14 12:44:03 2010
mtime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
crtime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
Size of extra inode fields: 28
EXTENTS:
(0): 557470

Alternatively, check its i-node number (with ls -i) and run debugfs aganist it (notice the compulsory angle brackets if using i-node number):

# debugfs -R 'stat <133370>' /dev/sda1

Inode: 133370 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1995841318 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 250
...


At last!

BTW, I'm being told perl can extract the crtime from the i-node, but haven't tried it yet...