EXT4 Journal & Inode Timestamps

Location

Description

EXT4 filesystem journal recording metadata transactions for crash recovery, and inode timestamps including crtime (creation/birth time), mtime (modification), atime (access), and ctime (metadata change) with nanosecond precision.

Forensic Value

The EXT4 journal enables recovery of recently deleted file metadata including filenames, sizes, and timestamps. The crtime (birth time) is immune to manipulation via the touch command (which only modifies mtime/atime/ctime), making it reliable for determining when a file was truly created. Comparing crtime against mtime detects timestomping attempts. Journal replay using debugfs can recover inode data for deleted files within the journal window.

Tools Required