2

I need to know the creation datetime of the filesystem on a disk (in a Linux machine) with C. I would like to avoid using shell commands, such as

tune2fs -l /dev/sdb2 | grep 'Filesystem created:'

and make a parser.

Thanks

klutt
  • 30,332
  • 17
  • 55
  • 95
Rockietto
  • 109
  • 1
  • 11
  • I'm searching for FileSystem creation datetime. The creation datetime of a file is easily editable. – Rockietto Dec 26 '17 at 14:25
  • 1
    tune2fs supports ext2/ext3/ext4, so you want to know ext filesystem creation datetime ? – xdebug Dec 26 '17 at 14:34
  • Yes. My HardDisk is an ext4. – Rockietto Dec 26 '17 at 14:37
  • 2
    On most Unix filesystems you can't; there is only {ctime,mtime,atime} And ctime is not time_of_creation, but time_of_change of inode attributes (such as rwx) – wildplasser Dec 26 '17 at 14:44
  • 1
    Can you clarify your question? Do you want to know the layout of the superblock so that you can extract the `s_mkfs_time` member? Do you need some sample GPL source code? Some sample non-GPL source code? The part of tune2fs that does what you want is https://github.com/tytso/e2fsprogs/blob/master/lib/e2p/ls.c#L314 – Mark Plotnick Dec 26 '17 at 15:20
  • This GitHub link is what I needed! Thank you! I can't add you reputation. Make an answer, and I will charge you reputation! – Rockietto Dec 26 '17 at 15:25
  • Could you motivate your question and explain why you need the creation date of the file system? On some filesystems, that information does not exist! What would you do in such case? – Basile Starynkevitch Dec 26 '17 at 18:21
  • Possible duplicate of [How to get file creation date in Linux?](https://stackoverflow.com/questions/5929419/how-to-get-file-creation-date-in-linux) – jww Dec 26 '17 at 18:24
  • Without motivations, your question is unclear, and has no sense on some file systems. What is your program trying to do ? – Basile Starynkevitch Dec 26 '17 at 18:44

1 Answers1

2

From a program coded in C (or in any language capable of calling C routines) you would use the stat(2) system call (or, with recent kernels and some file systems, the statx(2) one) to query the creation time of a given file (or directory). Of course, commands like ls(1) or stat(1) are using internally that stat(2) system calll.

There is no standard, and file system neutral, way to get the creation time of a given file system. That information is not always kept. I guess that FAT filesystems, or distributed file systems such as NFS, don't keep that.

You might use stat(2) on the mount point of that file system.

The statfs(2) system call retrieves some filesystem information, but does not give any time stamps.

For ext4 file systems, see ext4(5) and use proc(5). You might parse /proc/mounts and some /proc/fs/ext4/*/ directory. The pseudofiles in /proc/ can be parsed quickly and usually won't involve physical disk IO.

You could also work at the ext2/3/4 disk partition level, on an unmounted file ext[234] system, with a library like (or programs from) e2fsprogs. You should not access (even just read) a disk partition containing some file system if that file system is mounted.

(your question should give some motivation and context)

Basile Starynkevitch
  • 223,805
  • 18
  • 296
  • 547