Дата создания файла в Linux
В свойствах файла в файловом менеджере Linux зачастую отображается только информация о дате последнего обращения к нему и дате изменения. Но вот дата создания там, к сожалению, отсутствует. А иногда нужно посмотреть именно ее, например, чтобы узнать, с какого момента ведется запись лога.
В данной статье мы расскажем о том, какие данные хранятся в файловых системах Linux и объясним, как узнать дату создания файла Linux . Будут упомянуты сразу же два удобных способа, каждый из которых со своими особенностями.
Дата создания файла Linux
В стандарте POSIX прописаны только 3 вида временных меток, которые должна хранить файловая система:
- atime – время последнего обращения к файлу.
- mtime – время последнего изменения содержимого.
- ctime – время последней модификации прав доступа или владельца.
По этой причине в старых файловых системах посмотреть информацию о дате создания файла зачастую невозможно. А вот в современных файловых системах (ext4, zfs, XFS и т. д.) она уже сохраняется.
Данные о дате создания записываются в специальном поле:
Есть два удобных способа просмотра этой информации: с помощью утилиты stat и debugfs. Но первый способ подойдет не для всех дистрибутивов Linux. Второй способ – универсальный, но не такой простой в использовании. Разберемся с каждым из них по отдельности.
1. С помощью stat
Утилита stat выводит подробные сведения о файле. В том числе выводится дата создания файла Linux. Для ее запуска в терминале достаточно указать путь к файлу. Для примера посмотрим информацию про изображение pic_1.jpeg, хранящееся в каталоге /home/root-user/Pictures:
Нужная информация записана в графе Создан. А с помощью опции -c получится задать определенные правила форматирования для вывода информации, например, оставив только нужную графу:
stat -c ‘%w’ /home/root-user/Pictures/pic_1.jpeg
отдельной статье. Можете с ней ознакомиться.
2. С помощью debugfs
В отличие от утилиты stat, описанной в предыдущем разделе, у debugfs нет таких ограничений по версии. А значит, она будет работать всегда. Но и процедура использования у нее несколько более запутанная. Связано это с тем, что для просмотра даты создания файла через debugfs, нужно узнать номер его inode и файловую систему. Получить inode выйдет с помощью команды ls с опцией -i, указав путь к файлу:
ls -i /home/root-user/scripts/main_script.txt
А для просмотра файловой системы пригодится команда df:
Теперь все нужные данные собраны, и можно переходить к использованию утилиты debugfs. Ей нужно передать опцию -R, указать номер inode, а затем название файловой системы:
sudo debugfs -R ‘stat ‘ /dev/sda5
Подробное разъяснение о том, что такое inode, есть в специальной статье на нашем сайте.
Выводы
Мы разобрали два способа посмотреть дату создания файла Linux. Утилита stat несколько более удобная, ведь для нее достаточно указать только путь к нему. Но она не будет отображать нужную информацию до версии 8.31 GNU coreutils. А debugfs в этом плане более универсальная, но не такая простая в использовании. Ведь для получения данных она требует ввода номера inode файла и его файловую систему.
Обнаружили ошибку в тексте? Сообщите мне об этом. Выделите текст с ошибкой и нажмите Ctrl+Enter.
Get file created/creation time? [duplicate]
Is there a command in Linux which displays when the file was created ? I see that ls -l gives the last modified time, but can I get the created time/date?
Even while «OT» as this is asking for a tool to display this information, I think it’s a valuable thing for programmers to know when dealing with more UNIX-y filesystems.
The command is sudo debugfs -R ‘stat /path/to/file’ /dev/sdaX (replace sdaX with the device name of the filesystem on which the file resides). The creation time is the value of crtime . You can add | grep .[^ca]time to list just mtime (the modification time) and crtime (the creation time).
Some of the answers here are nearly 11 years old, and are no longer correct. This top-voted answer is recently edited/updated, and worth a look. Also — if you’re interested in sorting your ls output the Possible Duplicate also has an up-to-date answer that reflects our current systems’ status.
3 Answers 3
The stat command may output this — (dash). I guess it depends on the filesystem you are using. stat calls it the «Birth time». On my ext4 fs it is empty, though.
%w Time of file birth, human-readable; — if unknown
%W Time of file birth, seconds since Epoch; 0 if unknown
stat foo.txt File: `foo.txt' Size: 239 Blocks: 8 IO Block: 4096 regular file Device: 900h/2304d Inode: 121037111 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ adrian) Gid: ( 100/ users) Access: 2011-10-26 13:57:15.000000000 -0600 Modify: 2011-10-26 13:57:15.000000000 -0600 Change: 2011-10-26 13:57:15.000000000 -0600 Birth: - How do I find the creation time of a file?
I need to find the creation time of a file, when I read some articles about this issue, all mentioned that there is no solution (like Site1, Site2). When I tried the stat command, it states Birth: — . So how can I find the creation time of a file?
Keep in mind that the ‘creation time’ of a file is not guaranteed to be accurate. There are many ways to ‘fudge’ the creation dates on a file.
6 Answers 6
There is a way to know the creation date of a directory , just follow these steps :
- Know the inode of the directory by ls -i command (lets say for example its X)
- Know on which partition your directory is saved by df -T /path command ( lets say its on /dev/sda1 )
- Now use this command : sudo debugfs -R ‘stat ‘ /dev/sda1
You will see in the output :
crtime: 0x4e81cacc:966104fc -- mon Sep 27 14:38:28 2013 crtime is the creation date of your file .
What I tested :
- Created a directory at specific time .
- Accessed it .
- Modified it by creating a file .
- I tried the command and it gave an exact time .
- Then i modify it , and test again , the crtime remained the same , but modify and access time changed .
I post this , because i like to discuss so i can understand better , i am wonder why people say that Linux doesn’t support this feature
Because Linux itself does not. The ext4 filesystem does have this information but the kernel does not provide an API to access it. Apparently, debugfs extracts it directly from the filesystem so it does not need to use the kernel’s API. See here.
@Nux found a great solution for this which you should all upvote. I decided to write a little function that can be used to run everything directly. Just add this to your ~/.bashrc .
get_crtime() < for target in "$"; do inode=$(stat -c '%i' "$") fs=$(df --output=source "$" | tail -1) crtime=$(sudo debugfs -R 'stat "'>' "$" 2>/dev/null | grep -oP 'crtime.*--\s*\K.*') printf "%s\t%s\n" "$" "$" done > Now, you can run get_crtime to print the creation dates of as many files or directories as you like:
$ get_crtime foo foo/file foo Wed May 21 17:11:08 2014 foo/file Wed May 21 17:11:27 2014 Note that the creation date is not the creation date of the original file if the file is a copy (like it is with the modification date). Once a file is copied, the modification date is from the original, but the creation date is from the copy. (theres is some misunderstanding in this question: askubuntu.com/questions/529885/…)
@JacobVlijm well, yes, of course. Isn’t that obvious? How could it be otherwise? A copy is a new file that just happens to have the same contents as another. The modification time also changes for a copy by the way. It is set to the moment the copy was created unless you explicitly choose for that not to happen using cp -p or similar.
Absolutely, but it at the same time, it wouldn’t be that unlogical if, like the mod. date, somewhere in the file the date would be stored when it originated. I must admit I didn’t know that was not the case until I answered the linked question.
Just tried by the way, I just copied files in nautilus, modification date stays as it is (was), m. date is earlier than creation date.
@demongolem yes, the CentOS version of df doesn’t seem to support the —output option. In that case, you can replace that line with fs=$(df foo | awk ‘END’ and the function will work as well. All I’m showing in this answer is a way to wrap the command from the accepted answer in a way that can be run directly for file/directory targets.
The inability of stat to show the creation time is due to limitation of the stat(2) system call, whose return struct doesn’t include a field for the creation time. Starting with Linux 4.11 (i.e., 17.10 and newer*), however, the new statx(2) system call is available, which does include a creation time in its return struct.
* And possibly on older LTS releases using the hardware enablement stack (HWE) kernels. Check uname -r to see if you are using a kernel at least at 4.11 to confirm.
Unfortunately, it’s not easy to call system calls directly in a C program. Typically glibc provides a wrapper that makes the job easy, but glibc only added a wrapper for statx(2) in August 2018 (version 2.28, available in 18.10). The stat command itself gained support for statx(2) only in GNU coreutils 8.31 (released in March 2019), however, even Ubuntu 20.04 only has coreutils 8.30.
But I don’t think this will be backported to LTS releases even if they do get, or are already on, newer kernels or glibcs. So, I don’t expect stat on any current LTS release (16.04, 18.04 or 20.04) to ever print the creation time without manual intervention.
On 18.10 and newer, you can directly use the statx function as described in man 2 statx (note that the 18.10 manpage is incorrect in stating that glibc hasn’t added the wrapper yet).
And in Ubuntu 20.10, you will be able to use stat directly:
# stat --version stat (GNU coreutils) 8.32 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Michael Meskes. # stat / File: / Size: 4096 Blocks: 8 IO Block: 4096 directory Device: 88h/136d Inode: 57279593 Links: 1 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2020-08-18 06:57:46.912243164 +0000 Modify: 2020-08-18 06:57:06.768492334 +0000 Change: 2020-08-18 06:57:59.136165661 +0000 Birth: 2020-08-18 06:57:06.768492334 +0000 For older systems, luckily, @whotwagner wrote a sample C program that shows how to use the statx(2) system call on x86 and x86-64 systems. Its output is the same format as stat ‘s default, without any formatting options, but it’s simple to modify it to print just the birth time.
git clone https://github.com/whotwagner/statx-fun You can compile the statx.c code, or, if you just want the birth time, create a birth.c in the cloned directory with the following code (which is a minimal version of statx.c printing just the creation timestamp including nanosecond precision):
#define _GNU_SOURCE #define _ATFILE_SOURCE #include #include #include #include #include #include "statx.h" #include #include #include // does not (yet) provide a wrapper for the statx() system call #include /* this code works ony with x86 and x86_64 */ #if __x86_64__ #define __NR_statx 332 #else #define __NR_statx 383 #endif #define statx(a,b,c,d,e) syscall(__NR_statx,(a),(b),(c),(d),(e)) int main(int argc, char *argv[]) < int dirfd = AT_FDCWD; int flags = AT_SYMLINK_NOFOLLOW; unsigned int mask = STATX_ALL; struct statx stxbuf; long ret = 0; int opt = 0; while(( opt = getopt(argc, argv, "alfd")) != -1) < switch(opt) < case 'a': flags |= AT_NO_AUTOMOUNT; break; case 'l': flags &= ~AT_SYMLINK_NOFOLLOW; break; case 'f': flags &= ~AT_STATX_SYNC_TYPE; flags |= AT_STATX_FORCE_SYNC; break; case 'd': flags &= ~AT_STATX_SYNC_TYPE; flags |= AT_STATX_DONT_SYNC; break; default: exit(EXIT_SUCCESS); break; >> if (optind >= argc) < exit(EXIT_FAILURE); >for (; optind < argc; optind++) < memset(&stxbuf, 0xbf, sizeof(stxbuf)); ret = statx(dirfd, argv[optind], flags, mask, &stxbuf); if( ret < 0) < perror("statx"); return EXIT_FAILURE; >printf("%lld.%u\n", *&stxbuf.stx_btime.tv_sec, *&stxbuf.stx_btime.tv_nsec); > return EXIT_SUCCESS; > $ make birth $ ./birth ./birth.c 1511793291.254337149 $ ./birth ./birth.c | xargs -I <> date -d @<> Mon Nov 27 14:34:51 UTC 2017 In theory this should make the creation time more accessible:
- more filesystems should be supported than just the ext* ones ( debugfs is a tool for ext2/3/4 filesystems, and unusable on others)
- you don’t need root to use this (except for installing some required packages, like make and linux-libc-dev ).
Testing out an xfs system, for example:
$ truncate -s 1G temp; mkfs -t xfs temp; mkdir foo; sudo mount temp foo; sudo chown $USER foo $ touch foo/bar $ # some time later $ echo > foo/bar $ chmod og-w foo/bar $ ./birth foo/bar | xargs -I <> date -d @<> Mon Nov 27 14:43:21 UTC 2017 $ stat foo/bar File: foo/bar Size: 1 Blocks: 8 IO Block: 4096 regular file Device: 700h/1792d Inode: 99 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ muru) Gid: ( 1000/ muru) Access: 2017-11-27 14:43:32.845579010 +0000 Modify: 2017-11-27 14:44:38.809696644 +0000 Change: 2017-11-27 14:44:45.536112317 +0000 Birth: - However, this didn’t work for NTFS and exfat. I guess the FUSE filesystems for those didn’t include the creation time.