1

I want to change crtime properties in bash.

First, I tried to check the crtime as following command.

stat test

And next, I changed the timestamp.

touch -t '200001010101.11' test

But I realized that if the crtime is already past than the date I wrote, then it can't be changed.

So I want to know how to specify the crtime even it is already past.

Kyung Kyu Lee
  • 57
  • 5
  • https://stackoverflow.com/questions/16126992/setting-changing-the-ctime-or-change-time-attribute-on-a-file/17066309#17066309 – Digvijay S Sep 13 '20 at 07:15
  • @DigvijayS Thanks for your reference. but it said mtime, not creation time. I just want to know why crtime limited in setting time. – Kyung Kyu Lee Sep 13 '20 at 07:23

1 Answers1

1

Edit:

According to This answer to a similar question, you may be able to use debugfs -w -R 'set_inode_field ...' to change inode fields, though this does require unmounting.

man debugfs shows us the following available commmand:

set_inode_field filespec field value

Modify the inode specified by filespec so that the inode field field has value value. The list of valid inode fields which can be set via this command can be displayed by using the command: set_inode_field -l Also available as sif.

You can try the following to verify the inode number and name of the crtime field:

stat -c %i test

debugfs -R 'stat <your-inode-number>' /dev/sdb1

and additionally df -Th to find the /dev path of your filesystem (e.g. /dev/sdb1)

Followed by:

umount /dev/sdb1

debugfs -w -R 'set_inode_field <your-inode-number> crtime 200001010101.11' /dev/sdb1

Note: In the above commands, inode numbers must be indicated with <> brackets as shown. Additionally, as described here it may be necessary to flush the inode cache with echo 2 > /proc/sys/vm/drop_caches

Original answer:

You might try birthtime_touch:

birthtime_touch is a simple command line tool that works similar to touch, but changes a file's creation time (its "birth time") instead of its access and modification times.

From the birthtime_touch Github page, which also notes why this is not a trivial thing to accomplish:

birthtime_touch currently only runs on Mac OS X. The minimum required version is Mac OS X 10.6. birthtime_touch is known to work for files that are stored on HFS+ and MS-DOS filesystems.

The main problem why birthtime_touch does not work on all systems and for all filesystems, is that not all filesystems store a file's creation time, and for those that actually do store the creation time there is no standardized API to access/change that information.

This page has more details about the reasons why we haven't yet seen support for this feature.

Beyond this tool, it might be worth looking at the source on Github to see how it's accomplished and whether or not it might be portable to Unix/Linux. And beyond that, I imagine it would be necessary to write low level code to expose those aspects of the filesystems that crtime would be stored.

Joey Dodson
  • 38
  • 1
  • 7
  • Sorry for the late reply. My guess is that the answer depends on the version of the file system in Linux. The file system has different versions like ext2, ext3, ext4. In ext2, inode doesn't have crtime properties(it has {c, m, a}times) but in ext4, crtime properties were added. So for the backward compatibility, crtime is not the default option in newer file system. – Kyung Kyu Lee Sep 19 '20 at 15:27
  • But I don't find why the crtime can be modified only forward, not backward. – Kyung Kyu Lee Sep 19 '20 at 15:29
  • You mention using `touch -t`, but it's worth pointing out that touch is only able to change atime and/or mtime, and has no control over ctime and likely crtime (or birth time). See [https://unix.stackexchange.com/a/316387]. However, it appears that `debugfs` has options that may allow for it. I'll edit my answer to reflect that. – Joey Dodson Sep 20 '20 at 06:37