crtime.sh

#!/bin/bash

# Author: ashay dot humane at gmail.com
# Given a file name, this script prints the file creation time,
# as ext4 records it
# Might error out on other filesystems

DEBUGFS="/sbin/debugfs"

[[ -f "$1" ]] || { echo "Invalid filename. Exiting" ; exit 1; }

[[ -f "$DEBUGFS" ]] || { echo "/sbin/debugfs absent. Exiting" ; exit 1; }

[[ $EUID != 0 ]] && { echo "You are not root. Exiting" ; exit 1 ; }

INODE=$(ls -i "$1" |cut -d' ' -f1)

DEV=$(df "$1" | awk 'NR == 2 {print $1}')

CMD="${DEBUGFS} -R \"stat <${INODE}>\" ${DEV} 2>/dev/null"
#echo running: ${CMD}
#echo
BASETIME=$(eval ${CMD} | grep "crtime")

# Pull the YYYY-MM-DD HH:MM:SS hex timestamp out and convert to decimal
MAINHEX=$(echo $BASETIME | sed -e 's/ //g' | cut -f2 -d ":")
MAINDEC=$(($MAINHEX))

# Pull the nanosecond hex timestamp out and convert to decimal
NANOHEX=$(echo $BASETIME | sed -e 's/ //g' -e 's/-/:/g' | cut -f3 -d ":")
NANODEC=$((0x$NANOHEX))

# Convert the formatting to RFC 3339 and insert it into the output of stat
stat "$1" | grep -v Birth
echo " Birth: $(date -d @$MAINDEC.$(expr $NANODEC / 4) +"%F %T.%N %z")"