Linux Kernel inode timestamp

Question

I wanted to know which of the following entries of inode contains time at which file was created and time at which file was last modified ?

Thanks

Which of what following entries? You seem to have left something out of your question. — , Mar 06 '14 at 04:26
i_atime, i_mtime and i_ctime. which of following tell creation and modification times... — user3367692, Mar 06 '14 at 04:48

score 0 · Answer 1 · answered Mar 06 '14 at 05:10

Read the manual page for stat(2). This is straight from there:

       struct stat {
           dev_t     st_dev;     /* ID of device containing file */
           ino_t     st_ino;     /* inode number */
           mode_t    st_mode;    /* protection */
           nlink_t   st_nlink;   /* number of hard links */
           uid_t     st_uid;     /* user ID of owner */
           gid_t     st_gid;     /* group ID of owner */
           dev_t     st_rdev;    /* device ID (if special file) */
           off_t     st_size;    /* total size, in bytes */
           blksize_t st_blksize; /* blocksize for file system I/O */
           blkcnt_t  st_blocks;  /* number of 512B blocks allocated */
           time_t    st_atime;   /* time of last access */
           time_t    st_mtime;   /* time of last modification */
           time_t    st_ctime;   /* time of last status change */
       };

score 0 · Answer 2 · answered Mar 07 '14 at 17:24

The struct inode contains i_ctime (creation) and i_mtime (modification).

If you are in Kernel space and need to get these values for a given path the procedure is like this:

Declare a struct path then call kern_path with a path name to populate the struct, this allows you to access a struct dentry and within here is the struct inode. So path->dentry->d_inode.

Once you have a struct inode it's simply accessed like inode->ctime.tv_sec / inode->ctime.tv_nsec.

If you need to modify the values some extra work is required as per this proof of concept:

https://github.com/linuxthor/inode-ctime/blob/master/inode-ctime.c

Linux Kernel inode timestamp

2 Answers2