change birth creation date linux

sudo dd if=/dev/zero of=loop.img bs=100M count=10
sudo losetup -fP loop.img
sudo losetup -a
sudo mkfs.ext4 loop.img
mkdir loopfs
sudo mount -o loop /dev/loop0 loopfs
sudo touch loopfs/input.txt

sudo umount loopfs
sudo debugfs -R 'stat input.txt' /dev/loop0'

debugfs 1.45.5 (07-Jan-2020)
Inode: 15 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1856443764 Version: 0x00000000:00000001
User: 0 Group: 0 Project: 0 Size: 42313
File ACL: 0
Links: 1 Blockcount: 88
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5f2f4acc:78970acc -- Sun Aug 12 04:01:00 2020
atime: 0x5f33c7f3:7fd665f4 -- Sun Aug 12 04:01:00 2020
mtime: 0x5f2f4acc:78970acc -- Sun Aug 12 04:01:00 2020
crtime: 0x5f2f4acc:b79f2b04 -- Sun Aug 12 04:01:00 2020
Size of extra inode fields: 32
Extended attributes:
security.selinux (37) = "unconfined_u:object_r:unlabeled_t:s0\000"
Inode checksum: 0x6371117e
EXTENTS:
(0-10):33280-33290

sudo debugfs -w -R 'set_inode_field input.txt crtime 201808090101' /dev/loop0
sudo debugfs -w -R 'set_inode_field input.txt ctime 201808090101' /dev/loop0

Sometimes also need: echo 2 > /proc/sys/vm/drop_caches

Another way, but is not recommended to change system time:
NOW=$(date) && date -s "2022-08-10 21:10:10" && touch input.txt && date -s "$NOW"

Leave a Reply

Your email address will not be published. Required fields are marked *