Filesysteme Tipps und Tricks

Get the creation time... not the changetime

Creation time on zfs

You need the Filesystem where the file resides

<syntaxhighlight lang=bash>

1. df -h /var/data/dumps/sackhalter_20140407.dump

Filesystem Size Used Avail Use% Mounted on data/backup/dumps 24G 8.6G 16G 36% /var/data/dumps </source>

You need the i-node number of the file

<syntaxhighlight lang=bash>

1. ls -i /var/data/dumps/sackhalter_20140407.dump

103 /var/data/dumps/sackhalter_20140407.dump </source>

Get the metadata of the file

<syntaxhighlight lang=bash>

1. zdb -dddd data/backup/dumps 103 | grep crtime

crtime Tue Jul 29 13:00:18 2014 </source>

Creation time on ext2/3/4

You need the Filesystem where the file resides

<syntaxhighlight lang=bash>

1. df -h /usr/bin/passwd

Filesystem Size Used Avail Use% Mounted on /dev/sda1 15G 8.4G 5.8G 60% / </source>

You need the i-node number of the file

<syntaxhighlight lang=bash>

1. ls -i /usr/bin/passwd

130776 /usr/bin/passwd </source>

Get the metadata of the file

<syntaxhighlight lang=bash>

1. debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime

crtime: 0x5391870e:a6803fc8 -- Fri Jun 6 11:17:02 2014 </source>

Nice oneliner

<syntaxhighlight lang=bash>

1. file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'

crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd </source>