debugfs and "Bad magic number"

Question

I'm trying to get file creation time using whatever I could find on the Internet and there's generally one solution that works for everybody, and this is the tutorial: https://tecadmin.net/file-creation-time-linux/

And this is where it goes wrong:

root@namename:/home/name# debugfs -R 'stat <33567136>' /dev/sda1
debugfs 1.42.13 (17-May-2015)
/dev/sda1: Bad magic number in super-block while opening filesystem
stat: Filesystem not open
root@namename:/home/name#

I have no idea what to do with it, I'm a simple man, with simple wish, get 33567136's creation time (and every other file's afterwards).

When I Google this, results say that file system needs fixing because it is corrupted. However, my computer is working perfectly. There's nothing I can't access, no lag, no blocks, no inaccessibilities. It is also the only operating system.

I also weren't able to find clear tutorial on how to update debugfs in case of compatibility. sudo apt-get install debugfs and apt-get install --only-upgrade debugfs doesn't cut it: E: Unable to locate package debugfs. I weren't able to find the repo.

I would like to get the creation time, yet, can't because of issues I don't understand.

Linux `debugfs` only works for ext2/ext3/ext4 filesystem types. If you're using a distribution that uses e.g. an XFS or BTRFS filesystem by default, `debugfs` will not work unless you've explicitly specified the filesystem type as ext2/3/4 when creating the filesystem (probably at OS installation time). Basically, the "bad magic number" error message means "this does not look like an ext2/3/4 filesystem". `debugfs` is typically part of the `e2fsprogs` package. — telcoM, Feb 05 '21 at 09:33
I had the same problem, but realized while reading this question that I had accidentally used `/dev/sdc` when I in fact meant to use `/dev/sdc1` — forresthopkinsa, Mar 24 '21 at 18:25

Rui F Ribeiro · Answer 1 · 2018-02-11T14:20:10.813

As for the command debugfs -R 'stat <33567136>' /dev/sda1 failing when trying to fetch the info from inode 33567136:

I suspect you are just following blindly the tutorial you are linking;
copying the example verbatim to your system;
and so, you do not have in fact, a file with an inode 33567136 on your system.

stat thus gives an error, which in turn makes debugfs spew out another error.

Forget the tutorial asking you for using the inode for finding out the file creation time. stat also accepts as argument file names.

Thus you can do it as:

$sudo debugfs -R 'stat /bin/ls' /dev/sda1
Inode: 97034   Type: regular    Mode:  0755   Flags: 0x0
Generation: 388006688    Version: 0x00000000:00000001
User:     0   Group:     0   Project:     0   Size: 130736
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 264
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x58bc61b1:cf0b33e8 -- Sun Mar  5 19:06:25 2017
 atime: 0x58bc61ac:00000000 -- Sun Mar  5 19:06:20 2017
 mtime: 0x58ad82d1:00000000 -- Wed Feb 22 12:23:45 2017
crtime: 0x58bc61b0:a1448018 -- Sun Mar  5 19:06:24 2017
Size of extra inode fields: 32
BLOCKS:
(0-11):196420-196431, (IND):164667, (12-15):196432-196435, (16-31):531568-531583
TOTAL: 33

I will point out however, from man debugfs, that debugfs only works with extfs file systems:

NAME debugfs - ext2/ext3/ext4 file system debugger

DESCRIPTION The debugfs program is an interactive file system debugger. It can be used to examine and change the state of an ext2, ext3, or ext4 file system.

PS. As a reminder, if you have several partitions, the file system (/dev/sdax) has to match the partition where the file resides.

See also What is a Superblock, Inode, Dentry and a File?

debugfs and "Bad magic number"

1 Answers1