Filesysteme Tipps und Tricks

From Lolly's Wiki
Jump to navigationJump to search


Get the creation time... not the changetime

Creation time on zfs

You need the Filesystem where the file resides

# df -h /var/data/dumps/sackhalter_20140407.dump 
Filesystem         Size  Used Avail Use% Mounted on
data/backup/dumps   24G  8.6G   16G  36% /var/data/dumps

You need the i-node number of the file

# ls -i /var/data/dumps/sackhalter_20140407.dump 
103 /var/data/dumps/sackhalter_20140407.dump

Get the metadata of the file

# zdb -dddd data/backup/dumps 103 | grep crtime
	crtime	Tue Jul 29 13:00:18 2014

Creation time on ext2/3/4

You need the Filesystem where the file resides

# df -h /usr/bin/passwd 
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        15G  8.4G  5.8G  60% /

You need the i-node number of the file

# ls -i /usr/bin/passwd 
130776 /usr/bin/passwd

Get the metadata of the file

# debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime
crtime: 0x5391870e:a6803fc8 -- Fri Jun  6 11:17:02 2014

Nice oneliner

# file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'
crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd