I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?

My system uses the ext3 file system.

Thanks a lot!

  • 1
    A specific folder or file? Add a bit more information and an example, that will score you better answers ;) – Bruno Pereira Nov 11 '11 at 9:33
  • do you mean "at what date/time the file was created" or do you meant something in the lines of monitoring whether a certain file is being created? – xubuntix Nov 11 '11 at 9:34
  • Thanks Brunoperceira81, If possible, I would like to know both the creation time of some specific folder and specific file. :-) – Anand Nov 11 '11 at 9:35
  • 1
    Thanks Xubuntix. I mean that "at what date/time the file was created" . Thanks a lot! :-) – Anand Nov 11 '11 at 9:36

Most Unix-like operating systems don't store the creation time of file or directories. You can get their modification time, last access time, and inode change time via the ls and stat commands.

But, there are some third party tools as we can see in other answers. And, FreeBSD seems to have that capability. See @Graham Perrin's comment here which goes to that answer.

| improve this answer | |
  • I am using the latest Ubuntu 11.10. The install is by default. I didn't change anything. Then does that mean that my file system should not store the creation time? Thank you very much! :-) – Anand Nov 11 '11 at 9:38
  • As I said there is not a literal creation time info. It changes file by file but if modification time is not being changed since installtion, that could be creation time of course. Again, this question and its answer depends on spesific cases. – heartsmagic Nov 11 '11 at 9:44
  • 1
    this really depends on the filesystem. Ubuntus default is ext4, which supports the creation time. See my answer. – xubuntix Nov 11 '11 at 9:56
  • By the way, files and the directory that contains the files have been changed constantly since being created. – Anand Nov 11 '11 at 12:31
  • "Unix-like operating systems don't store the creation time of file or directories…" is too broad a statement. Consider unix.stackexchange.com/questions/20460/… – Graham Perrin Mar 26 '17 at 0:58

Assuming that you are using ext4, you can see when a file was created. The ext4 file system stores this as crtime.

You can get this information with the debugfs command.

Here is a script that you can run with superuser privileges to print the crtime of a file. (Note that it requires ruby and has a bug in the first line: #!/usr/bin/env ruby)

| improve this answer | |
  • Thanks xubuntix, I installed ruby and the code. It doesn't work. then I found that my file system is ext3 unfortunately.:-( – Anand Nov 11 '11 at 12:30
  • @xubuntix , this is a good info and I understand that I am a bit behind the developments :) Is whole script needed for that? With debugfs can't we get crtime? ie: debugfs -R 'stat ' file_name – heartsmagic Nov 11 '11 at 13:09
  • yes, debugfs alone will get you the crtime as well, but at least when I tried it, additional steps were required. And just to be clear: i did not write script, but i thought it was handy... – xubuntix Nov 11 '11 at 18:50
  • @xubuntix Thanks for pointing out the Ruby script, but even though I have an ext4 file system, it exits with an error message: crtime.ruby:47:in <main>': undefined method first' for "/dev/sda5":String (NoMethodError). – ᴠɪɴᴄᴇɴᴛ Dec 2 '14 at 12:20
  • I have an ext4 file system and my version of stat is recent enough to know about the creation time, but it shows a Birth: - line for every file I throw at it ... :( – ᴠɪɴᴄᴇɴᴛ Dec 2 '14 at 12:21

The brute force 'old school' way for ext3 is the "Tripwire" method (I named it from the insidious Tripwire product): build a list of files, then do it again, run diff. The more often you build your list and diff it, more close in time you will know when directories were both created AND deleted.

The two ways to build such a list is use: ls or to use lsof. You only need to save the diffs. If you know the user or the specific parent directory is not too large, then you can run it every second or more often (since sleep takes decimals) in a loop.

| improve this answer | |

You can use a third party tool to do the job : I think of OSSEC, which is able to monitor directory content and file modification.

| improve this answer | |
  • 1
    How does that tell you the point in time when an already existing file or directory was created? – user Nov 11 '11 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.