Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find the creation time of a file, when I read some article about this issue, all mentioned that there is no solution like Site1, Site2.

When I tried stat command it state Birth: -

So how can I find the creation time of a file?

share|improve this question
up vote 35 down vote accepted

There is a way to know the creation date of a directory , just follow these steps :

  1. Know the inode of the directory by ls -i command (lets say for example its X)

  2. Know on which partition your directory is saved by df -T /path command ( lets say its on /dev/sda1 )

  3. Now use this command : sudo debugfs -R 'stat <X>' /dev/sda1

You will see in the output :

crtime: 0x4e81cacc:966104fc -- mon Sep 27 14:38:28 2013

crtime is the creation date of your file .

What I tested :

  1. Created a directory at specific time .
  2. Accessed it .
  3. Modified it by creating a file .

  4. I tried the command and it gave an exact time .

  5. Then i modify it , and test again , the crtime remained the same , but modify and access time changed .
share|improve this answer
I post this , because i like to discuss so i can understand better , i am wonder why people say that Linux doesn't support this feature – nux May 21 '14 at 15:21
Because Linux itself does not. The ext4 filesystem does have this information but the kernel does not provide an API to access it. Apparently, debugfs extracts it directly from the filesystem so it does not need to use the kernel's API. See here. – terdon May 21 '14 at 15:31

@Nux found a great solution for this which you should all upvote. I decided to write a little function that can be used to run everything directly. Just add this to your ~/.bashrc.

get_crtime() {

    for target in "${@}"; do
        inode=$(stat -c '%i' "${target}")
        fs=$(df  --output=source "${target}"  | tail -1)
        crtime=$(sudo debugfs -R 'stat <'"${inode}"'>' "${fs}" 2>/dev/null | 
        grep -oP 'crtime.*--\s*\K.*')
        printf "%s\t%s\n" "${target}" "${crtime}"

Now, you can run get_crtime to print the creation dates of as many files or directories as you like:

$ get_crtime foo foo/file 
foo Wed May 21 17:11:08 2014
foo/file    Wed May 21 17:11:27 2014
share|improve this answer
@nux because the upvote method has a nasty effect --- the simple, "silly" answers are the one most upvoted, and the answer that requires a lot of work but interest few people are the less voted. Unavoidable, I fear. And about questions, I can't understand why people could answer or upvote an answer and not upvote the question. – Rmano May 21 '14 at 17:49
@nux well, I post questions when I have a problem, I don't actively search for good questions... ;-) I search for good answers, normally. (But this is off topic. I'll stop now. +1 to all, BTW). – Rmano May 21 '14 at 17:55
Note that the creation date is not the creation date of the original file if the file is a copy (like it is with the modification date). Once a file is copied, the modification date is from the original, but the creation date is from the copy. (theres is some misunderstanding in this question:…) – Jacob Vlijm Sep 29 '14 at 10:57
@JacobVlijm well, yes, of course. Isn't that obvious? How could it be otherwise? A copy is a new file that just happens to have the same contents as another. The modification time also changes for a copy by the way. It is set to the moment the copy was created unless you explicitly choose for that not to happen using cp -p or similar. – terdon Sep 29 '14 at 12:42
@demongolem yes, the CentOS version of df doesn't seem to support the --output option. In that case, you can replace that line with fs=$(df foo | awk '{a=$1}END{print a}' and the function will work as well. All I'm showing in this answer is a way to wrap the command from the accepted answer in a way that can be run directly for file/directory targets. – terdon Feb 24 at 18:52

TL;DR: Just run: sudo debugfs -R 'stat /path/to/your/file' /dev/<your fs>

(To figure out your fs, run df -T /path/to/your/file, most likely it's going to be /dev/sda1).

Long version:

We are going to run two commands:

  1. Find out the name of partition name for your file.
df -T /path/to/your/file

The output is going to look like this (partition name is first):

Filesystem     Type 1K-blocks    Used Available Use% Mounted on
/dev/<your fs> ext4   7251432 3481272   3509836  50% /
  1. Find out creation time for that file.

    sudo debugfs -R 'stat /path/to/your/file' /dev/

In the output look for ctime.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.