public
Created

Extract ext4 creation (crtime) of file

  • Download Gist
crtime.sh
Shell
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
#!/bin/bash
 
# Author: ashay dot humane at gmail.com
# Given a file name, this script prints the file creation time,
# as ext4 records it
# Might error out on other filesystems
 
DEBUGFS="/sbin/debugfs"
 
[[ -f "$1" ]] || { echo "Invalid filename. Exiting" ; exit 1; }
 
[[ -f "$DEBUGFS" ]] || { echo "/sbin/debugfs absent. Exiting" ; exit 1; }
 
[[ $EUID != 0 ]] && { echo "You are not root. Exiting" ; exit 1 ; }
 
INODE=$(ls -i "$1" |cut -d' ' -f1)
 
DEV=$(df "$1" | awk 'NR == 2 {print $1}')
 
CMD="${DEBUGFS} -R \"stat <${INODE}>\" ${DEV} 2>/dev/null"
echo running: ${CMD}
echo
eval ${CMD} | grep "crtime"

Please sign in to comment on this gist.

Something went wrong with that request. Please try again.