Linux change creation date on file

Setting creation or change timestamps

Using utimes , futimes , futimens , etc., it is possible to set the access and modification timestamps on a file. Modification time is the last time the file data changed. Similarly, «ctime» or change time, is the last time attributes on the file, such as permissions, were changed. (Linux/POSIX maintains three timestamps: mtime and ctime, already discussed, and ‘atime’, or access time.) Is there a function to set change timestamps? (Where «change» is the attribute modification or ‘ctime’, not modification time ‘mtime’.) (I understand the cyclic nature of wanting to change the change timestamp, but think archiving software — it would be nice to restore a file exactly as it was.) Are there any functions at all for creation timestamps? (I realize that ext2 does not support this, but I was wondering if Linux did, for those filesystems that do support it.) If it’s not possible, what is the reasoning behind it not being so?

@Madhur Ahuja: touch does not have a parameter (at least, my version does not or is not documented to have one) for changing creation or change times. touch will change modification or access times, however.

I see nothing on that page to indicate that touch has the capability to set change timestamps in any way. Note that I’m looking for change timestamps, which are a different beast from modification timestamps. I’ve tried to clarify my post on this point, if this is what is confusing. If it is not, what passage from that page gives you that suggestion?

@Madhur Ahuja: And pardon my unclear post. I will re-read it in a bit, to see if I can improve it once I’ve let myself get unfamiliar with it.

5 Answers 5

For ext2/3 and possibly for ext4 you can do this with debugfs tool, assuming you want to change the ctime of file /tmp/foo which resides in disk /dev/sda1 we want to set ctime to 201001010101 which means 01 January 2010, time 01:01:

Warning: Disk must be unmounted before this operation

# Update ctime debugfs -w -R 'set_inode_field /tmp/foo ctime 201001010101' /dev/sda1 # Drop vm cache so ctime update is reflected echo 2 > /proc/sys/vm/drop_caches 

Information taken from Command Line Kung Fu blog.

@eitan27 AFAIK debugfs will refuse to work if the disk is mounted, given it can harm the data on the disk.

@Eitan: Because you’re changing bytes on disk, not going through the kernel’s VFS cache. So the kernel’s in-memory data could get out of sync with the data structures on disk.

I had a similar issue, and wrote my answer here.

There are essentially two options:

1. Slight change in kernel (code included in link)
2. Change the system clock to the desired ctime, touch the file, then restore current time. (shell script for that included in link).

According to http://lists.gnu.org/archive/html/coreutils/2010-08/msg00010.html ctime cannot be faked (at least it’s not intended to be fakeable):

POSIX says that atime and mtime are user-settable to arbitrary times via the utimensat() family of syscalls, but that ctime must unfakeably track the current time of any action that changes a file’s metadata or contents.

If you just need to change a file’s ctime for some testing/debugging, bindfs might be helpful. It’s a FUSE filesystem which mounts one directory into another place, and can do some transformation on the file attributes. With option —ctime-from-mtime the ctime of each file is the same as its mtime, which you can set with touch -t .

I’m not experienced in that area; but according to unix.stackexchange.com/a/20464 the various standards don’t require file creation time to be stored. Some filesystems store creation time anyway, and it can be accessed with nonstandard ways.

ctime is not create-time but file attributes’ change-time. For example, the file size is such an attribute. Hence if you modify a file, ctime and mtime get altered. So backup tools can rely on ctime , as it cannot be faked (except if you warp the system time).

The easiest way:

1) change System time 2) copy paste a file on another location. 

I tried this on windows 7 and I succeed to change all three timestamps. The stat command on linux shows that all three timestamps are changed.

The script below automates running debugfs . set_inode_field . ctime . in ismail’s answer for many files. It will copy ctime values from files in /media/MYUSER/MYFS/FOO/BAR (recursively) to /media/MYUSER/MYFS2/FOO/BAR , and umount /media/MYUSER/MYFS2 as a side effect. It will work only if the filesystem of /media/MYUSER/MYFS2 is ext2, ext3 or ext4 (because debugfs works only for these filesystems).

mydev2="$(df /media/MYUSER/MYFS2 | perl -ne '$x = $1 if !m@^Filesystem @ and m@([^ ]+) @; END < print "$x\n" >')" cd /media/MYUSER/MYFS find FOO/BAR -type f | perl -ne 'chomp; my @st = lstat($_); if (@st and -f(_)) < s@"@""@g; print "set_inode_field \"/$_\" ctime \@$st[10]\n" >' >/tmp/sif.out sudo umount /media/MYUSER/MYFS2 # Repeat until success. sudo debugfs -w -f /tmp/sif.out /dev/"$mydev2" 

It handles filenames with whitespace and special characters correctly.

It works independently of time zones. As a limitation of debugfs, its precision is seconds, it ignores anything smaller (e.g. milliseconds, microseconds, nanoseconds). Depending the version of debugfs used, it may use 32-bit timestamps, thus it works correctly with dates before 2038-01-19.

If the current user doesn’t have enough read permissions for /media/MYUSER/MYFS , then the commands above should be run as root ( sudo bash ).

Источник

linux-shell: renaming files to creation time

Good morning everybody, for a website I’d like to rename files(pictures) in a folder from «1.jpg, 2.jpg, 3.jpg . » to «yyyymmdd_hhmmss.jpg» — so I’d like to read out the creation times an set this times as names for the pics. Does anybody have an idea how to do that for example with a linux-shell or with imagemagick? Thank you!

Do you mean the Unix time at which the file was created in the directory or the time that the EXIF data in the file says the photo was taken?

5 Answers 5

Naming based on file system date

for f in *.jpg do mv -n "$f" "$(date -r "$f" +"%Y%m%d_%H%M%S").jpg" done 

• for f in *.jpg do This starts the loop over all jpeg files. A feature of this is that it will work with all file names, even ones with spaces, tabs or other difficult characters in the names.
• mv -n «$f» «$(date -r «$f» +»%Y%m%d_%H%M%S»).jpg» This renames the file. It uses the -r option which tells date to display the date of the file rather than the current date. The specification +»%Y%m%d_%H%M%S» tells date to format it as you specified. The file name, $f , is placed in double quotes where ever it is used. This assures that odd file names will not cause errors. The -n option to mv tells move never to overwrite an existing file.
• done This completes the loop.

For interactive use, you may prefer that the command is all on one line. In that case, use:

for f in *.jpg; do mv -n "$f" "$(date -r "$f" +"%Y%m%d_%H%M%S").jpg"; done 

Naming based on EXIF Create Date

To name the file based on the EXIF Create Date (instead of the file system date), we need exiftool or equivalent:

for f in *.jpg do mv -n "$f" "$(exiftool -d "%Y%m%d_%H%M%S" -CreateDate "$f" | awk '')" done 

The above is quite similar to the commands for the file date but with the use of exiftool and awk to extract the EXIF image Create Date.

The exiftool command provides the date in a format like:

$ exiftool -d "%Y%m%d_%H%M%S" -CreateDate sample.jpg Create Date : 20121027_181338 

Источник

UNIX for Dummies Questions & Answers

324, 12

I am creating a file in unix today.
Is it possible to make the file created as 2 days older (or some past date)?
P.S:
i dont want to change the system date to older one and try.

44, 4

I Believe you can do this by touch command

touch newfile #will change modification time to current date and time

touch -t 8001031305 oldfile #sets the modification time of oldfile to 13:05 on January 3, 1980.

touch -r oldfile newfile # sets the modification time of newfile to that of oldfile.

324, 12

6,402, 678

The file creation date is the one date you cannot change with «touch». You can change the «last accessed» date and/or the «last modified» date.

324, 12

The file creation date is the one date you cannot change with «touch». You can change the «last accessed» date and/or the «last modified» date.

So, how we can get the file creation date?

6,402, 678

@pandeesh
In modern unix the nearest to file creation date is the «last modification date of the inode».

However this date is unreliable because it can be changed by certain backup software and anything which changes the inode like «chmod» . and of course the «touch» command itself !

11,728, 1,345

The file creation date (ctime) is not really the creation date in unix, it is the last time the inode data and some other metadata was modified.

chmod modifies ctime. assume the file is -rwxr-xr-x (755) then

chmod 755 filename # you have to own the file to do this

Linux chattr command can also change the ctime.

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Shell script to check current date file is created and with >0 kb or not for multiple directories

Hi All, I am new in scripting and working in a project where we have RSyslog servers over CentOS v7 and more than 200 network devices are sending logs to each RSyslog servers. For each network devices individual folders create on the name of the each network devices IP addresses.The main. (7 Replies)

Discussion started by: Pinaki

2. Shell Programming and Scripting

Find the file created on current date

Hi All, I’m trying to find a file which is created on current day. I searched in unix.com and i found, below command. find /land/ -mtime -1 -type f -print | grep «FF_Member_STG.dat» The command checks if the file with name «FF_Member_STG.dat» is created today then exit else proceed. . (3 Replies)

Discussion started by: ace_friends22

3. UNIX for Dummies Questions & Answers

How to get year part from file created date?

Hi Gurus, I need to get year part of file created date. when using ls -l , it only show month, day and time. is there any option I can add to get year portition? Thanks in advance (7 Replies)

Discussion started by: ken6503

4. Shell Programming and Scripting

Find first created file date in YYYYMMDD format

Hi All, We are copying all the files into ARCHIVE directory after we process them. We are doing this process from last 2 years, now we have a lot of files in ARCHIVE directory. Now I need to find when the first file is copied into this directory? If I Issue, ls -l /ARCHIVE/*.* | tail -1. (3 Replies)

Discussion started by: Raamc

5. Shell Programming and Scripting

Rename File Based on Created Date

I am trying to rename files based on the created/born date of the file. I Have a total of 4000 files that i am trying to do this with and would like it to be log_yyyymmddhh.gz right now the files are maillog. gz. Can anyone point me in the right direction of how to get this done via scipt? . (4 Replies)

Источник