Linux show file creation time

DEBUGFS Command – Show File Creation Times in Linux

In Unix-like systems such as Linux, everything is considered a file, and all information about a file (metadata or file attributes such as creation time, last modification etc..), except the actual file content are stored in an inode and Linux identifies each and every file by its inode number other than the human readable filename.

In addition, the Linux stat program is a useful utility for displaying file or file system status. It shows information such as inode number, time of file birth, last data modification, last access, last status change and much more. We will combine both programs to find actual file creation time in Linux.

In this article, we will explain how to find one of the critical attributes of a file using the debugfs and stat programs to obtain the following creation/access information for a file in Linux filesystems.

• ctime: Shows file change time.
• atime: Shows file access time.
• mtime: Shows file modification time.
• crtime: Shows file creation time.

Find File Creation Date in Linux

1. To find a file creation date and time “crtime” is to find the inode of the file using the stat command against a file called “About-TecMint”.

Alternatively, you can use the ls -i command against a file called “About-TecMint”.

From the output of the above commands, the file inode number is 14420015. Please make a note of this unique inode number as we will be using this inode number in the following steps.

2. Now we need to find the root filesystem that our file resides in, simply issue the following df -h command to identify the root file system.

From the above output, the filesystem for the root partition is /dev/sda10 (make a note of this filesystem). This will be different on your system.

3. Next, use the debugfs command to find the creation time of the file called “About-TecMint”, with the -R flag which instructs debugfs to execute the single external command specified with inode number 14420015 (stat in this case) and then exit.

From the above output it clears that the file “About-TecMint” was created on Mon Aug 1 10:26:36 2016 as provided by crtime. You will also see “ctime“, “atime” and “mtime” of your file.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

Источник

How to get ‘file creation time’ in Linux

I need to find out at what time and date a file has been created using C++ in Linux.

2 Answers 2

In Linux: three distinct timestamps associated with a file:

• time of last access of contents ( atime ),
• time of last modification of contents ( mtime ),
• and time of last modification of the inode (metadata, ctime ).

So, no, you cannot find file creation time. (reference). Some useful Links related to you question:

It seems no easy way to get exactly the creation time but you can get time of the last modification, last access and last status change.

You need to use the structure stat, defined in sys/stat.h. Here is the documentation on how to obtain and use this structure.

Not the answer you’re looking for? Browse other questions tagged c++ linux porting or ask your own question.

Linked

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

site design / logo © 2021 Stack Exchange Inc; user contributions licensed under cc by-sa. rev 2021.10.8.40416

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

Источник

How to find creation date of file?

I want to find out the creation date of particular file, not modification date or access date.

I have tried with ls -ltrh and stat filename .

7 Answers 7

stat -c ‘%w’ file on filesystems that store creation time.

The POSIX standard only defines three distinct timestamps to be stored for each file: the time of last data access, the time of last data modification, and the time the file status last changed.

Modern Linux filesystems, such as ext4, Btrfs, XFS (v5 and later) and JFS, do store the file creation time (aka birth time), but use different names for the field in question ( crtime in ext4/XFS, otime in Btrfs and JFS). Linux provides the statx(2) system call interface for retrieving the file birth time for filesystems that support it since kernel version 4.11. (So even when creation time support has been added to a filesystem, some deployed kernels have not immediately supported it, even after adding nominal support for that filesystem version, e.g., XFS v5.)

As Craig Sanders and Mohsen Pahlevanzadeh pointed out, stat does support the %w and %W format specifiers for displaying the file birth time (in human readable format and in seconds since Epoch respectively) prior to coreutils version 8.31. However, coreutils stat uses the statx() system call where available to retrieve the birth time only since version 8.31. Prior to coreutils version 8.31 stat accessed the birth time via the get_stat_birthtime() provided by gnulib (in lib/stat-time.h ), which gets the birth time from the st_birthtime and st_birthtimensec fields of the stat structure returned by the stat() system call. While for instance BSD systems (and in extension OS X) provide st_birthtime via stat , Linux does not. This is why stat -c ‘%w’ file outputs — (indicating an unknown creation time) on Linux prior to coreutils 8.31 even for filesystems which do store the creation time internally.

As Stephane Chazelas points out, some filesystems, such as ntfs-3g, expose the file creation times via extended file attributes.

Источник

How do I find the creation time of a file?

I need to find the creation time of a file, when I read some articles about this issue, all mentioned that there is no solution (like Site1, Site2).

When I tried the stat command, it states Birth: — .

So how can I find the creation time of a file?

5 Answers 5

There is a way to know the creation date of a directory , just follow these steps :

Know the inode of the directory by ls -i command (lets say for example its X)

Know on which partition your directory is saved by df -T /path command ( lets say its on /dev/sda1 )

Now use this command : sudo debugfs -R ‘stat ‘ /dev/sda1

You will see in the output :

crtime is the creation date of your file .

What I tested :

1. Created a directory at specific time .
2. Accessed it .

Modified it by creating a file .

I tried the command and it gave an exact time .

Then i modify it , and test again , the crtime remained the same , but modify and access time changed .

@Nux found a great solution for this which you should all upvote. I decided to write a little function that can be used to run everything directly. Just add this to your

Now, you can run get_crtime to print the creation dates of as many files or directories as you like:

The inability of stat to show the creation time is due to limitation of the stat(2) system call, whose return struct doesn’t include a field for the creation time. Starting with Linux 4.11 (i.e., 17.10 and newer*), however, the new statx(2) system call is available, which does include a creation time in its return struct.

_{* And possibly on older LTS releases using the hardware enablement stack (HWE) kernels. Check uname -r to see if you are using a kernel at least at 4.11 to confirm.}

Unfortunately, it’s not easy to call system calls directly in a C program. Typically glibc provides a wrapper that makes the job easy, but glibc only added a wrapper for statx(2) in August 2018 (version 2.28, available in 18.10). The stat command itself gained support for statx(2) only in GNU coreutils 8.31 (released in March 2019), however, even Ubuntu 20.04 only has coreutils 8.30.

But I don’t think this will be backported to LTS releases even if they do get, or are already on, newer kernels or glibcs. So, I don’t expect stat on any current LTS release (16.04, 18.04 or 20.04) to ever print the creation time without manual intervention.

On 18.10 and newer, you can directly use the statx function as described in man 2 statx (note that the 18.10 manpage is incorrect in stating that glibc hasn’t added the wrapper yet).

And in Ubuntu 20.10, you will be able to use stat directly:

For older systems, luckily, @whotwagner wrote a sample C program that shows how to use the statx(2) system call on x86 and x86-64 systems. Its output is the same format as stat ‘s default, without any formatting options, but it’s simple to modify it to print just the birth time.

You can compile the statx.c code, or, if you just want the birth time, create a birth.c in the cloned directory with the following code (which is a minimal version of statx.c printing just the creation timestamp including nanosecond precision):

In theory this should make the creation time more accessible:

• more filesystems should be supported than just the ext* ones ( debugfs is a tool for ext2/3/4 filesystems, and unusable on others)
• you don’t need root to use this (except for installing some required packages, like make and linux-libc-dev ).

Testing out an xfs system, for example:

However, this didn’t work for NTFS and exfat. I guess the FUSE filesystems for those didn’t include the creation time.

Источник

Get file creation time on Linux with EXT4 edit

Linux offers three timestamps for files: time of last access of contents (atime), time of last modification of contents (mtime), and time of last modification of the inode (metadata, ctime).

You may recover the file creation date if you deal with capble filesystem like EXT4 — journaling file system for Linux:

… Ext4 provides timestamps measured in nanoseconds. In addition, ext4 also adds support for date-created timestamps.

But there no consensus in the community on that so

… as Theodore Ts’o points out, while it is easy to add an extra creation-date field in the inode (thus technically enabling support for date-created timestamps in ext4), it is more difficult to modify or add the necessary system calls, like stat() (which would probably require a new version) and the various libraries that depend on them (like glibc). These changes would require coordination of many projects. So even if ext4 developers implement initial support for creation-date timestamps, this feature will not be available to user programs for now.

Let’s wait five years and see if there is actually any consensus on it being needed and used at all, rather than rush into something just because “we can”.

So what to do? Let’s chill out

Now let’s question yourself how would you extract this information? We end up with the STAT utility

Источник