Get file created (birth) time on linux

[ydkhatri]

Currently modified time is passed as created/birth time because of python's limitation (dependency on stat). This issue only affects running mac_apt in MOUNTED mode when the platform is linux.

The pyaff project has this implemented here: https://github.com/aff4/pyaff4/pull/6/files
We can use the same too!

[ydkhatri]

Even with this functionality, it will not work with apfs-fuse as FUSE (for linux) does not appear to have any support for populating birth time (crtime). FUSE has not been updated to use the newer statx() sys call structures !

[ydkhatri]

With the last update 7f8f4f, this is implemented, but won't be useful till FUSE implements statx!