Filesysteme Tipps und Tricks

Get the creation time... not the changetime

Creation time on zfs

You need the Filesystem where the file resides

# df -h /var/data/dumps/sackhalter_20140407.dump 
Filesystem         Size  Used Avail Use% Mounted on
data/backup/dumps   24G  8.6G   16G  36% /var/data/dumps

You need the i-node number of the file

# ls -i /var/data/dumps/sackhalter_20140407.dump 
103 /var/data/dumps/sackhalter_20140407.dump

Get the metadata of the file

# zdb -dddd data/backup/dumps 103 | grep crtime
	crtime	Tue Jul 29 13:00:18 2014

Creation time on ext2/3/4

You need the Filesystem where the file resides

# df -h /usr/bin/passwd 
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        15G  8.4G  5.8G  60% /

You need the i-node number of the file

# ls -i /usr/bin/passwd 
130776 /usr/bin/passwd

Get the metadata of the file

# debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime
crtime: 0x5391870e:a6803fc8 -- Fri Jun  6 11:17:02 2014

Nice oneliner

# file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'
crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd