We had this little discussion at work in regards of what would make a good linux technician and what kind of questions one would ask a potential candidate. One of them threw up the question: How do you get the creation time of a file?
Well asking any kind of questions and me trying to answer them is always going to be vague and undetailed, however my first guess was to look it up in the inode. I simply never did this before, but I knew it wasn't available in ls because the field isn't populated (tmk).
In Windows it is extremely easy, one will simply pull up the properties window of a file and voila, you get atime, crtime, ctime/mtime the whole shabang. Linux on the other hand...
Well I wasn't that far off. On Ext you can do this by finding the inode of the file, followed by using debugfs and stat to find the creation/birthtime of the file.
stat -c %i filename
debugfs -R 'stat <inode_number>' deviceHowever this is not the case in XFS. It seems to not be implemented what so ever! So I raised the question, how to detect hacks in OS'es like Red Hat Entreprise 7 which nowadays comes with XFS? Which btw seems unshrinkable! Growth works just fine, but shrinking?