When is Birth Date for a file actually used? [duplicate]

Question

When I type the following:

$ IFS=$'\n'; arr=( $(stat "/bin/bash") ); for i in ${arr[@]} ; do echo $i ; done
  File: '/bin/bash'
  Size: 1037528     Blocks: 2032       IO Block: 4096   regular file
Device: 823h/2083d  Inode: 656086      Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2017-05-23 16:38:03.848124217 -0600
Modify: 2017-05-16 06:49:55.000000000 -0600
Change: 2017-05-18 07:43:22.946694155 -0600
 Birth: -

I see the Birth Date for /bin/bash is null / empty. When is this field ever used and what purpose might it have in Linux when it works?

I appreciate there is a shorter way of using stat but this came up during development cycle and I copy and pasted.

Answer 1

Birth time is the time when the file was created on the filesystem, also known as the file creation time (crtime on EXTFS). Note that, this is not defined by POSIX; only last access time (atime), last modification time (mtime) and the inode change time (ctime) are mandated by POSIX.

IIRC, Linux yet does not provide any interface for getting the birth time, there is a proposal for xstat() and fxstat(), yet to be implemented.

As @muru noted, the newer approach is statx(), which is merged in the mainline kernel recently. So, any (modified) userspace tool can leverage that (the statx structure now, see below) on any such recent kernel.

struct statx {
    __u32   stx_mask;
    __u32   stx_blksize;
    __u64   stx_attributes;
    __u32   stx_nlink;
    __u32   stx_uid;
    __u32   stx_gid;
    __u16   stx_mode;
    __u16   __spare0[1];
    __u64   stx_ino;
    __u64   stx_size;
    __u64   stx_blocks;
    __u64   __spare1[1];
    struct statx_timestamp  stx_atime;
    struct statx_timestamp  stx_btime;
    struct statx_timestamp  stx_ctime;
    struct statx_timestamp  stx_mtime;
    __u32   stx_rdev_major;
    __u32   stx_rdev_minor;
    __u32   stx_dev_major;
    __u32   stx_dev_minor;
    __u64   __spare2[14];
};

Here stx_btime is the file creation time.

In the meantime, stat is showing absence of the fields (or the empty values) st_birthtime/st_birthtimesec returned by the stat() call, in the stat structure:

struct stat {
   dev_t     st_dev;     /* ID of device containing file */
   ino_t     st_ino;     /* inode number */
   mode_t    st_mode;    /* protection *
   nlink_t   st_nlink;   /* number of hard links */
   uid_t     st_uid;     /* user ID of owner */
   gid_t     st_gid;     /* group ID of owner */
   dev_t     st_rdev;    /* device ID (if special file) */
   off_t     st_size;    /* total size, in bytes */
   blksize_t st_blksize; /* blocksize for filesystem I/O */
   blkcnt_t  st_blocks;  /* number of 512B blocks allocated */
   time_t    st_atime;   /* time of last access */
   time_t    st_mtime;   /* time of last modification */
   time_t    st_ctime;   /* time of last status change */
   };

There are some tricks with filesystem level debugging request to get the creation info from FS metadata e.g. for EXTFS:

debugfs -R 'stat /path/to/file' /dev/sda1

assuming the FS of the file in question is on partition /dev/sda1. You can extract the value of crtime to get the creation time of the file.

Answer 2

It should be the file creation time, but there is an outstanding issue, the gnu coreutils team waiting for xstat() support in the kernel.

TODO: stat(1) and ls(1) support for birth time