NTFS-3G creation date of a file in Python

ntfs3gcr.py

import subprocess
from datetime import datetime, timezone


def get_ntfs3g_file_creation_date(path):
    # type: (str) -> str
    c = subprocess.run([
        'getfattr', '--only-values', '--name=system.ntfs_crtime', path
    ], capture_output=True)
    # Convert getfattr output's little-endian bytes to int, and convert
    # Microsoft time to Unix epoch time
    epoch = int.from_bytes(c.stdout, 'little')/10000000-11644473600
    # From there you can pass it in to datetime or any other date library.
    # Here I convert it to a UTC ISO 8601 str timestamp.
    return datetime.fromtimestamp(epoch, timezone.utc).isoformat()


# Example usage:
print(get_ntfs3g_file_creation_date('/path/to/file/on/ntfs'))
# -> 2016-02-13T08:10:59.525232+00:00