Is it possible to change a file "Birth date" (according to the stat file "Birth" field)?
I can change the modification/access time with touch -t 200109110846 file, but can't find the corresponding option for "Birth".
2 Answers
Like the last change time, the birth time isn’t externally controllable. On file systems which support it, the birth timestamp is set when a file is created, and never changes after that.
If you want to control it, you need to change the system’s notion of the current date and time, and create a new file.
As the question is specific about ext4: The ext2/3/4 file system debug tool debugfs allows to change anything, including the file birth timestamp. Unfortunately, you need to umount the file system with the file in question for this and then "open" it again with the debugfs tool, with the -w (write) option and the device special file as arguments. Then type this command at the prompt of debugfs:
set_inode_field /PATH crtime YYYYMMDDhhmmss
Alternatively, you can also use the inode number (as obtained from ls -i or stat) to reference the file:
set_inode_field <INODE> crtime YYYYMMDDhhmmss
As long, as you use debugfs only to set the crtime field, it shouldn't be too dangerous. It might probably still be a good idea to run fsck -f, first, on the file system. Be aware, though, that some of the other commands of debugfs can cause havoc to your data.
More details can be found on an answer on askubuntu: https://askubuntu.com/questions/1516195/fake-ext4-file-creation-dates-for-a-large-number-of-files-by-setting-the-system
I personally hope, that linux eventually adds a system call for manipulating the birth time. This may be particular important, when data is migrated to a new system or restored from a backup.
statx()from kernel 4.11 onwards does exposebtime.debugfs.