Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need to find the creation time of a file, when I read some article about this issue, all mentioned that there is no solution like Site1, Site2.

When I tried stat command it state Birth: -

So how can I find the creation time of a file?

share|improve this question

2 Answers 2

up vote 25 down vote accepted

There is a way to know the creation date of a directory , just follow these steps :

  1. Know the inode of the directory by ls -i command (lets say for example its X)

  2. Know on which partition your directory is saved by df -T /path command ( lets say its on /dev/sda1 )

  3. Now use this command : sudo debugfs -R 'stat <X>' /dev/sda1

You will see in the output :

crtime: 0x4e81cacc:966104fc -- mon Sep 27 14:38:28 2013

crtime is the creation date of your file .

What I tested :

  1. Created a directory at specific time .
  2. Accessed it .
  3. Modified it by creating a file .

  4. I tried the command and it gave an exact time .

  5. Then i modify it , and test again , the crtime remained the same , but modify and access time changed .
share|improve this answer
    
I post this , because i like to discuss so i can understand better , i am wonder why people say that Linux doesn't support this feature –  nux May 21 at 15:21
6  
Because Linux itself does not. The ext4 filesystem does have this information but the kernel does not provide an API to access it. Apparently, debugfs extracts it directly from the filesystem so it does not need to use the kernel's API. See here. –  terdon May 21 at 15:31

@Nux found a great solution for this which you should all upvote. I decided to write a little function that can be used to run everything directly. Just add this to your ~/.bashrc.

get_crtime() {

    for target in "${@}"; do
        inode=$(ls -di "${target}" | cut -d ' ' -f 1)
        fs=$(df  --output=source "${target}"  | tail -1)
        crtime=$(sudo debugfs -R 'stat <'"${inode}"'>' "${fs}" 2>/dev/null | 
        grep -oP 'crtime.*--\s*\K.*')
        printf "%s\t%s\n" "${target}" "${crtime}"
    done
}

Now, you can run get_crtime to print the creation dates of as many files or directories as you like:

$ get_crtime foo foo/file 
foo Wed May 21 17:11:08 2014
foo/file    Wed May 21 17:11:27 2014
share|improve this answer
1  
@nux because the upvote method has a nasty effect --- the simple, "silly" answers are the one most upvoted, and the answer that requires a lot of work but interest few people are the less voted. Unavoidable, I fear. And about questions, I can't understand why people could answer or upvote an answer and not upvote the question. –  Rmano May 21 at 17:49
2  
@nux well, I post questions when I have a problem, I don't actively search for good questions... ;-) I search for good answers, normally. (But this is off topic. I'll stop now. +1 to all, BTW). –  Rmano May 21 at 17:55
    
Note that the creation date is not the creation date of the original file if the file is a copy (like it is with the modification date). Once a file is copied, the modification date is from the original, but the creation date is from the copy. (theres is some misunderstanding in this question: askubuntu.com/questions/529885/…) –  Jacob Vlijm Sep 29 at 10:57
    
@JacobVlijm well, yes, of course. Isn't that obvious? How could it be otherwise? A copy is a new file that just happens to have the same contents as another. The modification time also changes for a copy by the way. It is set to the moment the copy was created unless you explicitly choose for that not to happen using cp -p or similar. –  terdon Sep 29 at 12:42
    
Absolutely, but it at the same time, it wouldn't be that unlogical if, like the mod. date, somewhere in the file the date would be stored when it originated. I must admit I didn't know that was not the case until I answered the linked question. –  Jacob Vlijm Sep 29 at 12:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.