Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?

My system uses the ext3 file system.

Thanks a lot!

share|improve this question
1  
A specific folder or file? Add a bit more information and an example, that will score you better answers ;) –  Bruno Pereira Nov 11 '11 at 9:33
    
do you mean "at what date/time the file was created" or do you meant something in the lines of monitoring whether a certain file is being created? –  xubuntix Nov 11 '11 at 9:34
    
Thanks Brunoperceira81, If possible, I would like to know both the creation time of some specific folder and specific file. :-) –  Anand Nov 11 '11 at 9:35
    
Thanks Xubuntix. I mean that "at what date/time the file was created" . Thanks a lot! :-) –  Anand Nov 11 '11 at 9:36

3 Answers 3

up vote 5 down vote accepted

Unix-like operating systems don't store the creation time of file or directories. You can get their modification time, last access time, and inode change time via the ls and stat commands.

share|improve this answer
    
I am using the latest Ubuntu 11.10. The install is by default. I didn't change anything. Then does that mean that my file system should not store the creation time? Thank you very much! :-) –  Anand Nov 11 '11 at 9:38
    
As I said there is not a literal creation time info. It changes file by file but if modification time is not being changed since installtion, that could be creation time of course. Again, this question and its answer depends on spesific cases. –  heartsmagic Nov 11 '11 at 9:44
    
this really depends on the filesystem. Ubuntus default is ext4, which supports the creation time. See my answer. –  xubuntix Nov 11 '11 at 9:56
    
By the way, files and the directory that contains the files have been changed constantly since being created. –  Anand Nov 11 '11 at 12:31

Assuming that you are using ext4, you can see when a file was created. The ext4 file system stores this as crtime.

You can get this information with the debugfs command.

Here is a script that you can run with superuser privileges to print the crtime of a file. (Note that it requires ruby and has a bug in the first line: #!/usr/bin/env ruby)

share|improve this answer
    
Thanks xubuntix, I installed ruby and the code. It doesn't work. then I found that my file system is ext3 unfortunately.:-( –  Anand Nov 11 '11 at 12:30
    
@xubuntix , this is a good info and I understand that I am a bit behind the developments :) Is whole script needed for that? With debugfs can't we get crtime? ie: debugfs -R 'stat ' file_name –  heartsmagic Nov 11 '11 at 13:09
    
yes, debugfs alone will get you the crtime as well, but at least when I tried it, additional steps were required. And just to be clear: i did not write script, but i thought it was handy... –  xubuntix Nov 11 '11 at 18:50

You can use a third party tool to do the job : I think of OSSEC, which is able to monitor directory content and file modification.

share|improve this answer
    
How does that tell you the point in time when an already existing file or directory was created? –  Michael Kjörling Nov 11 '11 at 13:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.