How to find creation date of file? Unix – Linux Stack Exchange

Get via App Store Read this post in our app!

How to find creation date of file?

I want to find out the creation date of particular file, not modification date or access date.

I have attempted with ls -ltrh and stat filename .

7 Answers

The POSIX standard only defines three distinct timestamps to be stored for each file: the time of last data access, the time of last data modification, and the time the file status last switched.

That said, modern Linux filesystems, such as ext4, Btrfs and JFS, do store the file creation time (aka birth time), but use different names for the field in question ( crtime in ext4, otime in Btrfs and JFS). However, presently Linux does not provide a kernel API for accessing the file creation times, even on filesystems supporting them.

As Craig Sanders and Mohsen Pahlevanzadeh pointed out, stat does support the %w and %W format specifiers for displaying the file birth time (in human readable format and in seconds since Epoch respectively). However, stat itself accesses the birth time via the get_stat_birthtime() provided by gnulib (in lib/stat-time.h ), which gets the birth time from the st_birthtime and st_birthtimensec fields of the stat structure returned by the stat() system call. While for example BSD systems (and in extension OS X) provide st_birthtime via stat , Linux does not. This is why stat -c ‘%w’ file outputs – (indicating an unknown creation time) on Linux even for filesystems which do store the creation time internally.

As Stephane Chazelas points out, some filesystems, such as ntfs-3g, expose the file creation times via extended file attributes.

TLDR, Use stap (“SystemTap”) to create your own kernel API. Demo of ext4 creation time extraction below.

You can extract the ext4 creation times on Fedora Nineteen systems. Here’s mine:

It’s clear that the inodes on my ext4 partitions have the creation time. Here’s a shell script that determines the inode associated with a filename and then augments the stat output with the creation time by using stap (“systemtap”).

NB: This is just a demo and hugely inefficient since a kernel module is created, loaded, and unloaded for every execution. This is also very likely very fragile as no error checking is performed. A decent kernel API would be preferable, but this script could be made much more efficient and read the creation times of numerous files/inodes.

[contents of stap_stat.sh]

In ext4 it is possible, because ext4 file-system store the file creation time. But still you will find that the stat guideline is incapable to display the date, this is because I think the kernel is still not having any APIs for the same.

Anyway the file birth time is stored in ext4 and you can find it out, albeit not a direct method, but using debugfs

sudo debugfs -R “stat /ABSOLUTE/PATH” /dev/sdxX | grep crtime

In theory, with GNU stat you could use stat -c ‘%w’ or %W to get a file’s creation date (aka birthtime).

In practice, most filesystems do not record that information and the linux kernel does not provide any way of accessing it.

The closest you can get is the file’s ctime, which is not the creation time, it is the time that the file’s metadata was last switched.

Linux Weekly News had an interesting article about this a few years back – http://lwn.net/Articles/397442/

In OS X you can use ls -lU , stat -f%B , GetFileInfo -d , or mdls -n kMDItemFSCreationDate :

Difference inbetween FreeBSD and GNU\Linux on stat instruction :

If you call stat directive in GNU\Linux it invokes the -x option, but in FreeBSD, you yourself should invoke the -x option.

Notes: –printf is very useful in scripting .

/dump.rdb ? Maybe my file system doesn’t support stat with %w. &ndash, Nathan Basanese Aug 21 ’15 at Nineteen:23

BTW, this works on ext4 only. I haven’t found a solution for BtrFS. yet ,)

Related movie: Harry Styles – Sign of the Times (Lyrics)


Leave a Reply

Your email address will not be published. Required fields are marked *