01Location
- Inode table of each block group (byte offset = index × s_inode_size)
02Questions it answers
- When was a file created (crtime), last modified (mtime), last changed in metadata (ctime) and last accessed (atime)?
- When was an inode deleted (dtime)?
- Do nanosecond values look natural or show signs of being set by a tool?
03Format and versions
| Format | Lower 128 bytes: i_atime (0x8), i_ctime (0xC), i_mtime (0x10), i_dtime (0x14) as 32-bit signed seconds. Extended area: i_ctime_extra (0x84), i_mtime_extra (0x88), i_atime_extra (0x8C), i_crtime (0x90), i_crtime_extra (0x94). In each *_extra field the low 2 bits extend the seconds and the upper 30 bits hold nanoseconds. |
|---|---|
| Applies to | Linux kernel ext4 documentation. Default inode records are 256 bytes; extended fields are valid only when i_extra_isize covers them. |
04Key fields
| Field | What it tells you |
|---|---|
| i_mtime / i_mtime_extra | Last data modification time. |
| i_ctime / i_ctime_extra | Last inode change time (metadata). |
| i_atime / i_atime_extra | Last access time. |
| i_crtime / i_crtime_extra | File creation time. |
| i_dtime | Deletion time; without the orphan_file feature it is reused as the next-orphan inode number for open unlinked inodes. |
| i_extra_isize | Bytes of the extended inode in use; defines which *_extra fields and crtime exist. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| atime, ctime, mtime, crtime | Unix seconds (int32) + 2 epoch bits + 30-bit nanoseconds | tv_sec = signed 32-bit value + 2^32 × epoch bits; valid until 2446-05-10. |
| dtime | Unix seconds (int32), not widened | Overflows in January 2038. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Read the superblock for s_inode_size and features, then locate the inode in its block group.
- Check i_extra_isize before reading *_extra fields and crtime.
- Decode seconds with the epoch bits and append nanoseconds; report all five times.
- On a live system use statx (STATX_BTIME) to obtain creation time; plain stat() does not return crtime.
07Interpretation pitfalls
- crtime and dtime are not returned by stat(); tools based on stat() show only atime, mtime and ctime.
- Kernel documentation notes long-standing bugs encoding dates beyond 2038 and before 1970 with the epoch bits.
- atime updates depend on mount options; a stale atime does not prove the file was not read.
- statx can return a mask without STATX_BTIME when the file system does not provide it.
09Sources
- ext4 Data Structures and Algorithms — Index Nodes (Inode Timestamps) The Linux Kernel documentation · checked 2026-10-14
- Linux kernel — Documentation/filesystems/ext4/inodes.rst Linux kernel (GitHub mirror) · checked 2026-10-14
- statx(2) — Linux manual page man7.org · checked 2026-10-14