Using debugfs -R 'stat <inode_nr> ' /dev/sda1 returns a result where there is a field crtime which i believe represents the creation date of a file pointed to by inode numbered inode_nr. I use this on an ext4 fs.
I know that the inode stores access_time, modification_time and change_time but not birth of a file
So my question is where is the creation time stored or how does the debugfs command retrieve it?
If the filesystem records file creation time (Not all do), it's stored in the inode along with the rest of the file metadata like modification and change times. It can be retrieved with the fairly recently added statx(2) system call in the stx_btime field of the struct statx that it populates. Note that there's no easy to use wrapper for it provided by glibc; you have to make the syscall directly.
debugfs probably examines the inode structures directly, though.
