Linux find time file created

How to get file creation date/time in Bash/Debian?

I’m using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time. ls -lh a.txt and stat -c %y a.txt both only give the modification time.

13 Answers 13

Unfortunately your quest won’t be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in .

EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.

Such sad news. It’d be so useful right now to determine easily whether a file has been deleted and recreated or has been there all along.

Do you know how that works on a Mac? The Finder shows three timestamps as ‘Created’, ‘Modified’, ‘Last openend’.

ls -i file #output is for me 68551981 debugfs -R 'stat ' /dev/sda3 # /dev/sda3 is the disk on which the file exists #results - crtime value [root@loft9156 ~]# debugfs -R 'stat ' /dev/sda3 debugfs 1.41.12 (17-May-2010) Inode: 68551981 Type: regular Mode: 0644 Flags: 0x80000 Generation: 769802755 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 38973440 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 76128 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 **crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013** Size of extra inode fields: 28 EXTENTS: (0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144 -9514): 357961728-357965098 

Источник

Get File Creation Date/Time in Bash

The Kubernetes ecosystem is huge and quite complex, so it’s easy to forget about costs when trying out all of the exciting tools.

To avoid overspending on your Kubernetes cluster, definitely have a look at the free K8s cost monitoring tool from the automation platform CAST AI. You can view your costs in real time, allocate them, calculate burn rates for projects, spot anomalies or spikes, and get insightful reports you can share with your team.

Connect your cluster and start monitoring your K8s costs right away:

1. Overview

In this tutorial, we’ll learn various methods to get the file creation date on Linux systems.

2. Why Can’t We Get the Creation Date on Old Systems?

Older systems run old versions of filesystems, which don’t store the file creation date.

As the POSIX standard only specifies three types of timestamps to be stored for a file, there is no requirement for a filesystem to support anything beyond them. These three timestamps store information about:

• Last data access – atime
• Last data modification – mtime
• File status changes – ctime

However, newer filesystems such as ext4, zfs, btrfs, JFS, and XFS do store the creation timestamp in separate fields:

These fields point to data stored in file inodes.

3. Getting the File Creation Date Using stat

The easiest way to get the file creation date is with the stat command.

Let’s create a file and check its creation time:

$ date; echo "Hello" > file Fri Dec 17 11:26:25 IST 2021 $ cat file Hello $ stat file File: file Size: 6 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 +0530 Modify: 2021-12-17 11:26:25.578441510 +0530 Change: 2021-12-17 11:26:25.578441510 +0530 Birth: 2021-12-17 11:26:25.578441510 +0530

As we can see, the creation date is shown in the “Birth” field.

Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time:

$ echo "Modified" >> file $ cat file Hello Modified $ stat file File: file Size: 15 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 +0530 Modify: 2021-12-17 11:28:32.290443553 +0530 Change: 2021-12-17 11:28:32.290443553 +0530 Birth: 2021-12-17 11:26:25.578441510 +0530

We can also instruct stat only to give us the required data, which is the file creation date in our case. For this, we can use the –format flag with %w as its value:

$ stat -c '%w' file 2021-12-17 11:26:25.578441510 +0530

Additionally, there are many other formats, which can be found with stat –help:

$ stat --help . The valid format sequences for files (without --file-system): . %U user name of owner %w time of file birth, human-readable; - if unknown %W time of file birth, seconds since Epoch; 0 if unknown %x time of last access, human-readable . 

4. Getting the File Creation Date Using debugfs

We can also use the debugfs command to find the creation date on ext4 filesystems. However, it is not as intuitive as the stat command since its primary purpose is to debug filesystems.

Firstly, we need the inode number of our file. We can find it with the ls command.

The -i flag makes ls print the inode numbers of files:

We also need the filesystem of the file. We can find this with the df command:

~ $ df ./file Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda2 26046564 8380600 16338936 34% /

Now, we can pass this information to the debugfs command. The syntax is debugfs -R ‘stat ’ /dev/sdX where inode is our file inode, and /dev/sdX is the filesystem of the file:

$ sudo debugfs -R 'stat ' /dev/sda2 debugfs 1.46.4 (18-Aug-2021) Inode: 5118705 Type: regular Mode: 0644 Flags: 0x80000 Generation: 2975709199 Version: 0x00000000:00000001 User: 1000 Group: 1000 Project: 0 Size: 8 File ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 atime: 0x61bc3224:7f8fe250 -- Fri Dec 17 06:45:56 2021 mtime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 crtime: 0x61bc2b65:71f8e150 -- Fri Dec 17 06:17:09 2021 Size of extra inode fields: 32 Inode checksum: 0x5ddd5b4b EXTENTS: (0):5279293

Here, the creation time is in the crtime field mentioned earlier. We can see that we created the file on “Fri Dec 17 06:17:09 2021”.

While the ctime field sounds similar to crtime, it does not tell us the file creation date. It shows us the last time the file status was changed due to modifications such as changing the file permissions.

5. Conclusion

In this article, we covered the historical reasons for the unavailability of file creation dates, along with the methods to get the creation date on modern systems.

Источник

How to get file creation date in Linux?

I am working with batches of files that contain information about the same object at the different times of its life, and the only way to order them is by creation date. I was using this:

//char* buffer has the name of file struct stat buf; FILE *tf; tf = fopen(buffer,"r"); //check handle fstat(tf, &buf); fclose(tf); pMyObj->lastchanged=buf.st_mtime; 

But that does not seems to work. What am I doing wrong? Are there other, more reliable/simple ways to get file creation date under Linux?

fstat doesn’t fetch a «file created» timestamp value because many filesystems don’t track that data. What filesystem are you working with?

One that is standard for latest Ubuntu desktop, i suppose — i am running my code on the virtual machine (vmware player, to be exact), and left all details like filesystem to ubuntu installer.

If that code compiled without warnings, you have a major problem with your compiler. If that code compiled with warnings, learn to pay heed to warnings about incorrect argument types (or pointer to integer conversions) and fix the code so it compiles without warnings.

5 Answers 5

The nearest approximation to ‘creation date’ is the st_ctime member in the struct stat , but that actually records the last time the inode changed. If you create the file and never modify its size or permissions, that works as a creation time. Otherwise, there is no record of when the file was created, at least in standard Unix systems.

For your purposes, sort by st_mtime . or get the files named with a timestamp in the name.

Note that if you are on Darwin (Mac OS X), the creation time is available. From the man page for stat(2) :

However, when the macro _DARWIN_FEATURE_64_BIT_INODE is defined, the stat structure will now be defined as:

Note the st_birthtimespec field. Note, too, that all the times are in struct timespec values, so there is sub-second timing ( tv_nsec gives nanosecond resolution). POSIX 2008 requires the struct timespec time keeping on the standard times; Darwin follows that.

Sadly, the files are created by another application. Sadly, i haven’t got permissions to change anything about it.

fstat works on file descriptors, not FILE structures. The simplest version:

#include #include #include #ifdef HAVE_ST_BIRTHTIME #define birthtime(x) x.st_birthtime #else #define birthtime(x) x.st_ctime #endif int main(int argc, char *argv[]) < struct stat st; size_t i; for( i=1; ireturn 0; > 

You will need to figure out if your system has st_birthtime in its stat structure by inspecting sys/stat.h or using some kind of autoconf construct.

@srv19 You can get the file descriptor by using open(2) or by using fileno(tf). What I’ve given you however is a way to inspect it’s attributes without having to open the file. If you need to open the file anyway and want to use stdio functions, then fileno is your friend.

Your solution got rid of my problem. Thanks a lot. I’ve suspected i was mission something in the usage of fstat.

File creation time is not stored anywhere, you can only retrieve one of the following:

time_t st_atime; /* time of last access */ time_t st_mtime; /* time of last modification */ time_t st_ctime; /* time of last status change */ 

Your code should give you the last modification time, however. Note: you can use stat() instead of fstat() without opening the file ( stat() takes the file name as param).

To get the file creation date in linux, I use the following method

root@sathishkumar# cat test.txt > Hello > This is my test file > _eof root@sathishkumar# cat test.txt Hello This is my test file root@sathishkumar# ls -i test.txt 2097517 test.txt root@sathishkumar# debugfs -R 'stat ' /dev/sda5 Inode: 2097517 Type: regular Mode: 0664 Flags: 0x80000 Generation: 4245143992 Version: 0x00000000:00000001 User: 1000 Group: 1000 Size: 27 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x50ea6d84:4826cc94 -- Mon Jan 7 12:09:00 2013 atime: 0x50ea6d8e:75ed8a04 -- Mon Jan 7 12:09:10 2013 mtime: 0x50ea6d84:4826cc94 -- Mon Jan 7 12:09:00 2013 crtime: 0x5056d493:bbabf49c -- Mon Sep 17 13:13:15 2012 Size of extra inode fields: 28 EXTENTS: (0):8421789 

atime: Last time file was opened or executed

ctime: Time the inode information was updated. ctime also gets updated when file is modified

crtime: File creation time

Источник