Understand ext4, Timestamps)

Prepare the environment

First, create another test file in the EXT4 file system.

# echo Time for knowledge >testfile# touch -a -t 211101231917.42 testfile# touch -m -t 204005160308.19 testfile

You can use the touch command to directly modify the atime (last access time) and mtime (last modification time) of the file. In this way, you can set these timestamps to the desired time, otherwise, the atime and mtime timestamps of the newly created file will be the time when the file is created. One thing that needs to be pointed out is that the atime and mtime I just set are all distant future time points. In the old Unix file system, because the time information is 32-bit, so it will cause some trouble (such as the "2038 problem" or the unix Millennium Bug ).

Now, let's compare the stat command in standard linux, The istat and debugfs stat output results in Sleuthkit:

# stat testfile File: `testfile' Size: 19  Blocks: 8 IO Block: 4096 regular fileDevice: fc03h/64515d Inode: 6554914 Links: 1Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)Access: 2111-01-23 19:17:42.000000000 -0800Modify: 2040-05-16 03:08:19.000000000 -0700Change: 2011-03-12 07:36:13.872411014 -0800# istat /dev/mapper/RD-home 6554914inode: 6554914AllocatedGroup: 800[...]Inode Times:Accessed:       Tue Dec 17 12:49:26 1974File Modified:  Wed May 16 03:08:19 2040Inode Modified: Sat Mar 12 07:36:13 2011[...]# debugfs -R 'stat ' /dev/mapper/RD-home[...] ctime: 0x4d7b92ed:cfffbe18 -- Sat Mar 12 07:36:13 2011 atime: 0x0954b156:00000001 -- Tue Dec 17 12:49:26 1974 mtime: 0x845e5913:00000000 -- Wed May 16 03:08:19 2040crtime: 0x4d7b92e4:148af06c -- Sat Mar 12 07:36:04 2011[...]

I have edited the output so that the timestamp is obvious. As you can see, these three commands output the same mtime and ctime, but istat and debugfs encountered problems when parsing atime in 2111, only the stat command obtains the correct value.

You may have noticed some new features of EXT4:

• The timestamp output by the STAT command and debugfs command carries a decimal part. Currently, the ext4 Timestamp can be accurate to milliseconds (nanosecond ).
• The "crtime" (create time) item can be seen in the stat of debugfs. In ext4, the "birth" timestamp of the file is finally supported, just like NTFS, used to mark the time when a file is created.
• At least the stat and touch commands can perfectly support future timestamps. The implementation method of ext4 has been solved (in fact, it is postponed) in 2038.

EXT4 provides these functions through a 64-bit timestamp, which gives you enough space to support timestamp in milliseconds. In addition, there are two other spaces that can meet future timestamp scaling requirements.

Show Details

However, as I mentioned, EXT4 developers have done their best to make EXT4 backward compatible with the inode structures of EXT2 and EXT3. The 64-bit Timestamp and the new file creation time item are obviously in conflict with this target. The EXT4 developer can solve this problem by setting an extension part in the high 256 bits of the EXT4 128-bit inode.

This is the result displayed in a 16-bit Editor (refer to the first part ):

When inode of a file is set to 0, the highlighted timestamp areas are as follows:

Bytes   8 -  11: Access time seconds       12 -  15: Change time seconds       16 -  19: Modification time seconds
      132 - 135: Change time "extra"      136 - 139: Modification time "extra"      140 - 143: Access time "extra"      144 - 147: Create time seconds      148 - 151: Create time "extra"

The standard MACtime value at the start of inode does not change in nature. They are in seconds since January 1, January 1, 1970 (the year of unix), and then EXT4 saves these values in the form of unsigned numbers rather than signed numbers. The extended bits are used to change the question 2038 to question 2106 ".

You can see the mtime in the example above in 2040. The value of mtime in hexadecimal format is 0x845e5913 or 2220775699 in decimal format, which may cause an overflow of 32-Bit Signed numbers. You can use the following command to convert the decimal number to a readable Date:

# date -d @2220775699

Wed May 16 03:08:19 PDT 2040