#!/usr/bin/python3

import btrfs
import sys

if len(sys.argv) < 2:
    print("Usage: {} <mountpoint>".format(sys.argv[0]))
    sys.exit(1)


def suspicious_inodes(fs):
    min_key = btrfs.ctree.Key(btrfs.ctree.FIRST_FREE_OBJECTID, 0, 0)
    max_key = btrfs.ctree.Key(btrfs.ctree.LAST_FREE_OBJECTID, -1, -1)
    for root in fs.subvolumes():
        tree = root.objectid
        for header, data in btrfs.ioctl.search_v2(fs.fd, tree, min_key, max_key):
            if header.type == btrfs.ctree.INODE_ITEM_KEY:
                inode = btrfs.ctree.InodeItem(header, data)
                if inode.otime.sec >= 422212465065984:
                    _, path_bytes = btrfs.ioctl.ino_lookup(fs.fd, tree, inode.objectid)
                    yield {
                        'tree': tree,
                        'path': path_bytes.decode(),
                        'atime': inode.atime.iso8601,
                        'ctime': inode.ctime.iso8601,
                        'otime sec.nsec': "{}.{}".format(inode.otime.sec, inode.otime.nsec),
                    }


with btrfs.FileSystem(sys.argv[1]) as fs:
    btrfs.utils.pretty_print(suspicious_inodes(fs))