File creation time on a lvm partition

[csptra]

Hello Everyone,

I'm trying to see if I can get the creation date of a file (if possible) from an lvm partition. Searching the internet (and trying) a few methods already have not lead me to promising results.

I have tried stat, ls -lc, and debugfs.

ls -lc returns a date, but this timestamp is after a normal ls -l timestamp. I have read that ls -l shows modify time.

stat will show the birth as - , and from what I understand, this means NULL, or not listed.


debugfs will just say "Bad magic number in super-block while opening filesystem" when using the below command

debugfs -R 'stat <inode#>' /dev/mapper/lvm

Is there any pointers someone can direct me to? I am still learning this.

Thanks

[TrevorH]

LVM doesn't come into this at all. It's a filesystem function, nothing to do with LVM.

[csptra]

Hi,

Thanks for taking the time for answering. I was thinking I need to put the mapper when it said /dev/sda1 (for example) on debugfs. Should I see what physical drive(s) the lvm is using and put that in my debugfs?

[TrevorH]

It jsut wants the block device name so for example:

Code: Select all

# debugfs -R 'stat /etc/os-release'  /dev/mapper/vg_xps13-lv_root 
debugfs 1.42.9 (28-Dec-2013)
Inode: 1704809   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 1574261938    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 393
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5be64443:9ebcdc70 -- Sat Nov 10 02:36:51 2018
 atime: 0x5be9d399:340cc26c -- Mon Nov 12 19:25:13 2018
 mtime: 0x5bbb79f7:00000000 -- Mon Oct  8 16:38:31 2018
crtime: 0x5be64443:9e42c9b0 -- Sat Nov 10 02:36:51 2018
Size of extra inode fields: 28
Extended attributes stored in inode body: 
  selinux = "system_u:object_r:etc_t:s0\000" (27)
EXTENTS:
(0):6849420