Get file created/creation time? [duplicate]
Is there a command in Linux which displays when the file was created ? I see that ls -l gives the last modified time, but can I get the created time/date?
Even while «OT» as this is asking for a tool to display this information, I think it’s a valuable thing for programmers to know when dealing with more UNIX-y filesystems.
The command is sudo debugfs -R ‘stat /path/to/file’ /dev/sdaX (replace sdaX with the device name of the filesystem on which the file resides). The creation time is the value of crtime . You can add | grep .[^ca]time to list just mtime (the modification time) and crtime (the creation time).
Some of the answers here are nearly 11 years old, and are no longer correct. This top-voted answer is recently edited/updated, and worth a look. Also — if you’re interested in sorting your ls output the Possible Duplicate also has an up-to-date answer that reflects our current systems’ status.
3 Answers 3
The stat command may output this — (dash). I guess it depends on the filesystem you are using. stat calls it the «Birth time». On my ext4 fs it is empty, though.
%w Time of file birth, human-readable; — if unknown
%W Time of file birth, seconds since Epoch; 0 if unknown
stat foo.txt File: `foo.txt' Size: 239 Blocks: 8 IO Block: 4096 regular file Device: 900h/2304d Inode: 121037111 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ adrian) Gid: ( 100/ users) Access: 2011-10-26 13:57:15.000000000 -0600 Modify: 2011-10-26 13:57:15.000000000 -0600 Change: 2011-10-26 13:57:15.000000000 -0600 Birth: - How to check all timestamps of a file?
Is there a command in Linux to check all timestamps of a file? I’m trying to see the last modified, created, and touched dates on the file.
Just to point out, Linux files don’t have birth dates. Thus, it’s not possible to determine the date a file was created.
@FatalError: Various filesystems already support birth/creation timestamps; the real trouble is in accessing such extra information. (One can’t just extend struct stat without breaking things, unfortunately. ) You can try out debugfs -R «stat » /dev/sdXY for ext4, replacing 1234 with an ino.
@grawity: Neat! I always wondered why no fs had it. but I guess they do, but like you said, can’t just go breaking the ABI for existing binaries. Thanks for the tip :).
@FatalError, Birth time can be displayed with Linux stat command, see How to find creation date of file? and What file systems on Linux store the creation time?.
2 Answers 2
$ stat test 234881026 41570368 -rw-r--r-- 1 werner staff 0 0 "Feb 7 16:03:06 2012" "Feb 7 16:03:06 2012" "Feb 7 16:03:06 2012" "Feb 7 16:03:06 2012" 4096 0 0 test If you want to adjust the format, refer to the man pages, since the output is OS-specific and varies under Linux/Unix.
Generally, you can get the times through a normal directory listing as well:
- ls -l outputs last time the file content was modified, the mtime
- ls -lc outputs last time of file status modification, the ctime (What’s the difference?)
- ls -lu outputs last access time, the atime (although the usefulness of this concept is subject to discussion)
And of course, ctime does not record when a file was «created». The POSIX specification defines only three timestamps, but some Linux filesystems store Birth Time/Creation Time. How to find creation date of file? On such a supported configuration, one could use
stat --printf '%n\nmtime: %y\nctime: %z\natime: %x\ncrtime:%w\n' stat is really detailed. But ls only needs one line. It would be good if it could also display seconds. However, when creating lists of files, the former one is perfectly suitable.
I’ve noticed that the result of ls -l can show a different date format when there is BusyBox installed (on Android). I think that without it , it’s like «2019-07-26 14:41» , and with it, it’s like «May 6 21:27» . How come the year is missing ? Is there a way to force it using the format of without it?
@androiddeveloper Like I said, the answer depends on the OS. I think you should open a new question. If you are talking about Android specifically, perhaps Stack Overflow or Android Enthusiasts would be more fitting.
@slhck Well it’s the same OS, just with BusyBox installed. I asked if it’s possible (meaning : is there a command to use) to get the format that will be shown.
There are only THREE distinct times values stored for each of your files, as defined by the POSIX Standard : http://pubs.opengroup.org/onlinepubs/9699919799/ (see Base Definitions section -> 4. General Concepts -> 4.8 File Times Update)
Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in .
atime is for Last data access timestamp. mtime is for Last data modification timestamp. ctime is for Last file status change timestamp. Following examples show the difference among the atime, mtime and ctime, these examples are in GNU/Linux BASH. You can use stat -x in Mac OS X or other BSD Dist. to see the similar output format.
$ stat --version stat (GNU coreutils) 8.4 Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Michael Meskes. $ $ touch test $ stat test File: `test' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 811h/2065d Inode: 98828525 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 514/ rank) Gid: ( 514/ rank) Access: 2014-03-16 10:58:28.609223953 +0800 Modify: 2014-03-16 10:58:28.609223953 +0800 Change: 2014-03-16 10:58:28.609223953 +0800 When the file just be created, three timestamps are the same.
1. atime
First, let’s access the file’s data by reading it ( less or vim ), printing it out ( cat ) or copy it to another file ( cp ).
$ cat test #Nothing will be printed out, since the file is empty $ stat test File: `test' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 811h/2065d Inode: 98828525 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 514/ rank) Gid: ( 514/ rank) Access: 2014-03-16 10:59:13.182301069 +0800 2. ctime
Now let's change the file status, by changing the permission ( chmod ) or renaming it ( mv )
$ chmod u+x test $ stat stet File: `test' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 811h/2065d Inode: 98828525 Links: 1 Access: (0764/-rwxrw-r--) Uid: ( 514/ rank) Gid: ( 514/ rank) Access: 2014-03-16 10:59:13.182301069 +0800 Modify: 2014-03-16 10:58:28.609223953 +0800 Change: 2014-03-16 11:04:10.178285430 +0800 Note that until now, the contents (data) of the file is still the same as when it created.
3. mtime
Finally, let's modify the contents of the file by editing the file.
$ echo 'Modify the DATA of the file' > testing $ echo 'Modify the DATA of the file also change the file status' > testing $ stat testing File: `testing' Size: 56 Blocks: 8 IO Block: 4096 regular file Device: 811h/2065d Inode: 98828525 Links: 1 Access: (0764/-rwxrw-r--) Uid: ( 514/ rank) Gid: ( 514/ rank) Access: 2014-03-16 10:59:13.182301069 +0800 Modify: 2014-03-16 11:09:48.247345148 +0800 4. birth time
Also note that the newer version of stat (e.g. stat --version 8.13 in Ubuntu 12.04) has 4th timestamp information - the Birth Time (file creation time). Although it may not show the correct time for now:
$ stat --version stat (GNU coreutils) 8.13 Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Michael Meskes. $ $ stat birth_time File: `birth_time' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 805h/2053d Inode: 4073946 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 1000/ bingyao) Gid: ( 1000/ bingyao) Access: 2014-03-16 10:46:48.838718970 +0800 Modify: 2014-03-16 10:46:48.838718970 +0800 Change: 2014-03-16 10:46:48.838718970 +0800 Birth: - How to get file creation date/time in Bash/Debian?
I'm using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time. ls -lh a.txt and stat -c %y a.txt both only give the modification time.
13 Answers 13
Unfortunately your quest won't be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)
Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in .
EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.
Such sad news. It'd be so useful right now to determine easily whether a file has been deleted and recreated or has been there all along.
Do you know how that works on a Mac? The Finder shows three timestamps as 'Created', 'Modified', 'Last openend'.
ls -i file #output is for me 68551981 debugfs -R 'stat ' /dev/sda3 # /dev/sda3 is the disk on which the file exists #results - crtime value [root@loft9156 ~]# debugfs -R 'stat ' /dev/sda3 debugfs 1.41.12 (17-May-2010) Inode: 68551981 Type: regular Mode: 0644 Flags: 0x80000 Generation: 769802755 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 38973440 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 76128 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 **crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013** Size of extra inode fields: 28 EXTENTS: (0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144 -9514): 357961728-357965098