Set ctime to birthtime

fox-it · Sep 20, 2024 · 1c23c5f · 1c23c5f
1 parent f6ac993
commit 1c23c5f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/dissect/target/filesystems/ntfs.py b/dissect/target/filesystems/ntfs.py
@@ -178,14 +178,16 @@ def lstat(self) -> fsutil.stat_result:
                 size,
                 stdinfo.last_access_time.timestamp(),
                 stdinfo.last_modification_time.timestamp(),
-                stdinfo.last_change_time.timestamp(),
+                # ctime gets set to creation time for python <3.12 purposes
+                stdinfo.creation_time.timestamp(),
             ]
         )
 
         # Set the nanosecond resolution separately
         st_info.st_atime_ns = stdinfo.last_access_time_ns
         st_info.st_mtime_ns = stdinfo.last_modification_time_ns
-        st_info.st_ctime_ns = stdinfo.last_change_time_ns
+
+        st_info.st_ctime_ns = stdinfo.creation_time_ns
 
         st_info.st_birthtime = stdinfo.creation_time.timestamp()
         st_info.st_birthtime_ns = stdinfo.creation_time_ns

diff --git a/tests/filesystems/test_ntfs.py b/tests/filesystems/test_ntfs.py
@@ -118,10 +118,11 @@ def test_stat_information(sector_size: int, size: int, resident: bool, expected_
         assert stat_info.st_atime_ns == 1726043227939040100
         assert stat_info.st_mtime == 1726043227.939039
         assert stat_info.st_mtime_ns == 1726043227939040100
-        assert stat_info.st_ctime == 1691773811.593225
-        assert stat_info.st_ctime_ns == 1691773811593226000
+        assert stat_info.st_ctime == 1651900642.631773
+        assert stat_info.st_ctime_ns == 1651900642631774900
         assert stat_info.st_birthtime == 1651900642.631773
         assert stat_info.st_birthtime_ns == 1651900642631774900
 
         assert stat_info.st_blksize == sector_size
         assert stat_info.st_blocks == expected_blks
+