Linux when file was created

How to get file creation date/time in Bash/Debian?

I’m using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time. ls -lh a.txt and stat -c %y a.txt both only give the modification time.

13 Answers 13

Unfortunately your quest won’t be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in .

EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.

Such sad news. It’d be so useful right now to determine easily whether a file has been deleted and recreated or has been there all along.

Do you know how that works on a Mac? The Finder shows three timestamps as ‘Created’, ‘Modified’, ‘Last openend’.

ls -i file #output is for me 68551981 debugfs -R 'stat ' /dev/sda3 # /dev/sda3 is the disk on which the file exists #results - crtime value [root@loft9156 ~]# debugfs -R 'stat ' /dev/sda3 debugfs 1.41.12 (17-May-2010) Inode: 68551981 Type: regular Mode: 0644 Flags: 0x80000 Generation: 769802755 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 38973440 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 76128 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 **crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013** Size of extra inode fields: 28 EXTENTS: (0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144 -9514): 357961728-357965098 

Источник

How to Find Out File Creation Date and Time in Linux

Sometimes, you might be interested to know when a file was created on a Linux system. In this guide, we will check out how to do exactly that. We will explore various ways that you can find out the file creation date on a Linux system.

1. Check the File Creation Date in Linux

The stat command is a command line utility that displays detailed information about a file. It lists information that includes file size, UID (User ID), GID (Group ID), file access, modification time, and creation dates.

To check the file creation date, simply run the following command where sample1.txt is the name of the file

From the output, the Birth directive shows the file creation date.

To narrow down to the file creation date, pass the -c %w arguments as shown.

Let’s make a few changes to the file by adding content using the echo command.

$ echo "Some Text" >> sample1.txt

When you view the file details, you’ll observe that the Modify field changes to indicate that the modification time has changed.

2. Display File Creation Date Using Debugfs Command

The other way of checking the file creation date is by using the debugfs command. However, this is a multi-stage operation and more complex than the stat command.

First, you need to get the file’s inode number using the ls command shown.

Next, find the partition where the file is located using the df command shown

Finally, run the following debugfs command to find out the file creation date.

$ sudo debugfs -R 'stat ' /dev/sda5

The crtime field displays the file creation time and date.

You are all set! In this guide, we have looked at two ways of revealing or checking the file creation date on a Linux system.

Источник

How to Determine When the File Was Created on Linux

Files play a key role for your operating system as they are critical to run everything smoothly and function properly. Knowing the file creation date of system files is sometimes important for security reasons as it tells you when the file was actually created. For example, if someone made changes to any system file then you can easily find then some changes were made. You can find the file creation time of any file using a utility named “debugfs” but to utilize this command you need to first find the inode number of the file which is a unique number assigned to every new file when it was created first so for that first create a test file first by typing.

After that, find the file inode by typing:

After getting the inode number you need to type the following command to get the information regarding the disk:

In the above image /dev is the device file that is present in the root directory whereas sda5 is the hard disk that belongs to the Linux OS as shown below and you can get the information regarding this specific directory by typing.

In the above image “crtime” will tell the file creation time of a certain file and along with that you can also see “ctime”, “atime” and “mtime”.

So in the above image, mtime will show you the time when the file was altered or modified last time. For example, you might have added something to the file, removed something from the file, or changed the file’s contents.

The next one is the atime represents when the last time a file was accessed or read, for example, you may have opened the file or used the cat command to read the contents of a file. The file has not been altered or changed in any way.

The ctime does not refer to modifications made to a file’s contents. Rather, it refers to the moment when the file’s information was updated for example changes in the file permissions.

Now let’s try to find the file creation time of any system file for example ”systemd” and for that, you need to first find the inode number by typing.

As you can see, the inode number for the “systemd” file is 131200, so to find the file creation time you need to type.

Similarly, you can find the file creation timestamp for multiple files by writing a single command:

If you are interested in when the created files were modified last time, you can do that by typing:

If you are looking for a specific file, you need to follow the general syntax below:

Similarly, you can see that when the timestamp for when the file was modified, and its content changed by typing:

As you can see that the timestamp for the above commands is the same, so to give you a better picture, let’s edit the text file by writing any random lines and then save that file. This will change the time stamp, and you will see a new time, as shown below:

Conclusion

Linux OS can have multiple users in it and knowing file creation time is sometimes important especially for system administrators. Different users have different types of expertise so for auditing purposes, it is necessary to know which user is creating which type of file for security reasons as it might contain viruses as well.

About the author

Taimoor Mohsin

Hi there! I’m an avid writer who loves to help others in finding solutions by writing high-quality content about technology and gaming. In my spare time, I enjoy reading books and watching movies.

Источник

Is there a way to know the creation time of a file in ubuntu?

i am using ubuntu and want to know the creation time of a file even when it gets modified or accessed ?

I just noticed that in ext4 (not sure about other FS), if you list with «ls -li» (to list inodes), it seems to display the creation date. I didn’t found any reference to it, so maybe I’m wrong (at least it seems to work for me).

7 Answers 7

Unfortunately Unix does not store the creation time of a file.

All you are able to get using stat is

Note: When using filesystem type ext4 crtime is available!

This little script can get the creation date for ext4:

#!/bin/sh fn=`realpath $1` echo -n "Querying creation time of $1. " sudo debugfs -R "stat $fn" /dev/sda4|grep crtime 

I named it fcrtime and put it in my ~/bin folder. So in any folder I can use the command like: fcrtime example.odp

crtime: 0x5163e3f0:12d6c108 — Tue Apr 9 12:48:32 2013

Compared to stat-ing the same file:

 File: `example.odp' Size: 54962 Blocks: 112 IO Block: 4096 regular file Device: 804h/2052d Inode: 11019246 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 1000/ fulop) Gid: ( 1000/ fulop) Access: 2013-04-09 13:20:05.263016001 +0300 Modify: 2013-04-09 13:20:05.227016001 +0300 Change: 2013-04-09 13:20:05.227016001 +0300 Birth: - 

1. realpath is usually not installed by default. In Ubuntu eg. install it with sudo apt-get install realpath
2. Replace /dev/sda4 if necessary with the one you get from mount|grep ext4

Источник

Get file created/creation time? [duplicate]

Is there a command in Linux which displays when the file was created ? I see that ls -l gives the last modified time, but can I get the created time/date?

Even while «OT» as this is asking for a tool to display this information, I think it’s a valuable thing for programmers to know when dealing with more UNIX-y filesystems.

The command is sudo debugfs -R ‘stat /path/to/file’ /dev/sdaX (replace sdaX with the device name of the filesystem on which the file resides). The creation time is the value of crtime . You can add | grep .[^ca]time to list just mtime (the modification time) and crtime (the creation time).

Some of the answers here are nearly 11 years old, and are no longer correct. This top-voted answer is recently edited/updated, and worth a look. Also — if you’re interested in sorting your ls output the Possible Duplicate also has an up-to-date answer that reflects our current systems’ status.

3 Answers 3

The stat command may output this — (dash). I guess it depends on the filesystem you are using. stat calls it the «Birth time». On my ext4 fs it is empty, though.

%w Time of file birth, human-readable; — if unknown

%W Time of file birth, seconds since Epoch; 0 if unknown

stat foo.txt File: `foo.txt' Size: 239 Blocks: 8 IO Block: 4096 regular file Device: 900h/2304d Inode: 121037111 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ adrian) Gid: ( 100/ users) Access: 2011-10-26 13:57:15.000000000 -0600 Modify: 2011-10-26 13:57:15.000000000 -0600 Change: 2011-10-26 13:57:15.000000000 -0600 Birth: - 

Источник