How do I get the creation date of a file on an NTFS logical volume?

I created an NTFS logical volume on my Linux system for Windows file storage because I want to retain the creation date of my files (I would probably zip them into an archive and then unzip them, though I have no idea if that would work). Does NTFS-3G save the creation date of files on Linux? If so, how do I access it?

Reading this thread, the OP links documentation on NTFS that provides a shell script for finding the creation date. I modified it in an attempt to get the seconds from the hex value, but I believe that I am doing something wrong:

#!/bin/sh
CRTIME=`getfattr -h -e hex -n system.ntfs_times $1 | 
    grep '=' | sed -e 's/^.*=(0x................).*$/1/'`
SECONDS=$(($CRTIME / 10000000))
echo `date --date=$SECONDS`

Contents hide

Answers:

Method 1

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

From https://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/#filetimes,

An NTFS file is qualified by a set of four time stamps “representing the number of 100-nanosecond intervals since January 1, 1601 (UTC)”, though UTC has not been defined for years before 1961 because of unknown variations of the earth rotation.

You’ll find even more information in there including:

Newer versions of ntfs-3g expose a ntfs.ntfs_crtime and ntfs.ntfs_crtime_be attribute.

So:

getfattr --only-values -n system.ntfs_crtime_be /some/file |
  perl -MPOSIX -0777 -ne '$t = unpack("Q>");
  print ctime $t/10000000-11644473600'

See also:

ntfsinfo -F /file/in/ntfs /dev/fs-device

With older ntfs-3g, this should work:

getfattr --only-values -n system.ntfs_times /some/file |
  perl -MPOSIX -0777 -ne 'print ctime unpack(Q)/10000000-11644473600'

Or with GNU tools and sub-second precision:

date '+%F %T.%N' -d "@$({ echo 7k
  getfattr --only-values -n system.ntfs_times /some/file |
    od -A n -N 8 -vt u8; echo '10000000/ 11644473600-p'; } |dc)"

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes

Article Rating