Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to find out the creation date of particular file, not modification date or access date.

I have tried with ls -ltrh and stat filename.

share|improve this question
2  
Linux doesn't keep track of the creation time since it is not required by POSIX. However, Mac OS X does with the HFS filesystem — look under "birth time" in stat(1). –  200_success Sep 18 '13 at 5:15
    
Fedora 19 ext4 filesystems do set file creation times. I'm sure there are many more examples. See answer below that uses stap to retrieve creation times. –  rickhg12hs Oct 15 '13 at 13:11
    
see unix.stackexchange.com/questions/7562/… –  jlliagre Feb 25 '14 at 19:08

6 Answers 6

The POSIX standard only defines three distinct timestamps to be stored for each file: the time of last data access, the time of last data modification, and the time the file status last changed.

That said, modern Linux filesystems, such as ext4, Btrfs and JFS, do store the file creation time (aka birth time), but use different names for the field in question (crtime in ext4, otime in Btrfs and JFS). However, currently Linux does not provide a kernel API for accessing the file creation times, even on filesystems supporting them.

As Craig Sanders and Mohsen Pahlevanzadeh pointed out, stat does support the %w and %W format specifiers for displaying the file birth time (in human readable format and in seconds since Epoch respectively). However, stat itself accesses the birth time via the get_stat_birthtime() provided by gnulib (in lib/stat-time.h), which gets the birth time from the st_birthtime and st_birthtimensec fields of the stat structure returned by the stat() system call. While for instance BSD systems (and in extension OS X) provide st_birthtime via stat, Linux does not. This is why stat -c '%w' file outputs - (indicating an unknown creation time) on Linux even for filesystems which do store the creation time internally.

As Stephane Chazelas points out, some filesystems, such as ntfs-3g, expose the file creation times via extended file attributes.

share|improve this answer
3  
On Linux, it is now stored in many filesystems including ext4. There's no kernel API yet to get it though. Some file systems like ntfs-3g over fuse make it available via the extended attribute API –  Stéphane Chazelas Sep 18 '13 at 6:30
    
@StephaneChazelas Thank you for your comments. Updated the answer to provide more details. –  Thomas Nyman Sep 18 '13 at 8:06
    
You can use stap to create your own kernel API. See example in answer here. –  rickhg12hs Oct 15 '13 at 13:12

TLDR; Use stap ("SystemTap") to create your own kernel API. Demo of ext4 creation time extraction below.

You can extract the ext4 creation times on Fedora 19 systems. Here's mine:

$ uname -a
Linux steelers.net 3.11.1-200.fc19.i686.PAE #1 SMP Sat Sep 14 15:20:42 UTC 2013 i686 i686 i386 GNU/Linux

It's clear that the inodes on my ext4 partitions have the creation time. Here's a shell script that determines the inode associated with a filename and then augments the stat output with the creation time by using stap ("systemtap").

NB: This is just a demo and hugely inefficient since a kernel module is created, loaded, and unloaded for every execution. This is also probably very fragile as no error checking is performed. A proper kernel API would be preferable, but this script could be made much more efficient and read the creation times of multiple files/inodes.

[contents of stap_stat.sh]

#/bin/sh

my_inode_str=$(stat --printf="%i" $1)

stap - << end_of_stap_script
global my_offsetof
probe begin {
  system("stat $1");
  my_offsetof = &@cast(0,"struct ext4_inode_info")->vfs_inode;
}
probe kernel.function("ext4_getattr@fs/ext4/inode.c") {
  probe_inode=\$dentry->d_inode;
  if (@cast(probe_inode, "struct inode")->i_ino == $my_inode_str) {
    my_i_crtime = &@cast(probe_inode - my_offsetof,"struct ext4_inode_info")->i_crtime;
    printf("CrTime: %s GMT\n", ctime(@cast(my_i_crtime, "timespec")->tv_sec));
    printf("CrTime (nsecs): %d\n", @cast(my_i_crtime, "timespec")->tv_nsec);
    exit();
  }
}
end_of_stap_script

Here's a demo:

$ ll testfile
ls: cannot access testfile: No such file or directory
$ touch testfile
$ ./stap_stat.sh testfile
  File: ‘testfile’
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: fd02h/64770d    Inode: 4850501     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1001/    Rick)   Gid: ( 1001/    Rick)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2013-09-28 06:17:04.221441084 -0400
Modify: 2013-09-28 06:17:04.221441084 -0400
Change: 2013-09-28 06:17:04.221441084 -0400
 Birth: -
CrTime: Sat Sep 28 10:17:04 2013 GMT
CrTime (nsecs): 220441085
$ ll testfile
-rw-rw-r--. 1 Rick Rick 0 Sep 28 06:17 testfile
$ cat - >> testfile 
Now is the time ...
$ ll testfile 
-rw-rw-r--. 1 Rick Rick 20 Sep 28 06:18 testfile
$ ./stap_stat.sh testfile
  File: ‘testfile’
Device: fd02h/64770d    Inode: 4850501     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1001/    Rick)   Gid: ( 1001/    Rick)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2013-09-28 06:17:04.221441084 -0400
Modify: 2013-09-28 06:18:33.684374740 -0400
Change: 2013-09-28 06:18:33.684374740 -0400
 Birth: -
CrTime: Sat Sep 28 10:17:04 2013 GMT
CrTime (nsecs): 220441085
$ cat testfile 
Now is the time ...
$ ./stap_stat.sh testfile
  File: ‘testfile’
  Size: 20          Blocks: 8          IO Block: 4096   regular file
Device: fd02h/64770d    Inode: 4850501     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1001/    Rick)   Gid: ( 1001/    Rick)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2013-09-28 06:19:12.199349463 -0400
Modify: 2013-09-28 06:18:33.684374740 -0400
Change: 2013-09-28 06:18:33.684374740 -0400
 Birth: -
CrTime: Sat Sep 28 10:17:04 2013 GMT
CrTime (nsecs): 220441085
$ mv testfile testfile2
$ ./stap_stat.sh testfile2 
  File: ‘testfile2’
  Size: 20          Blocks: 8          IO Block: 4096   regular file
Device: fd02h/64770d    Inode: 4850501     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1001/    Rick)   Gid: ( 1001/    Rick)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2013-09-28 06:19:12.199349463 -0400
Modify: 2013-09-28 06:18:33.684374740 -0400
Change: 2013-09-28 06:20:45.870295668 -0400
 Birth: -
CrTime: Sat Sep 28 10:17:04 2013 GMT
CrTime (nsecs): 220441085
$ 
share|improve this answer

In theory, with GNU stat you could use stat -c '%w' or %W to get a file's creation date (aka birthtime).

In practice, most filesystems do not record that information and the linux kernel does not provide any way of accessing it.

The closest you can get is the file's ctime, which is not the creation time, it is the time that the file's metadata was last changed.

Linux Weekly News had an interesting article about this a few years back - http://lwn.net/Articles/397442/

share|improve this answer
stat --printf='%w' yourfile #human readable

stat --printf='%W' yourfile  #seconds from Epoch , 0 if unknown

Difference between FreeBSD and GNU\Linux on stat command:

If you call stat command in GNU\Linux it invokes the -x option, but in FreeBSD, you yourself should invoke the -x option.

Notes: --printf is very useful in scripting....!

share|improve this answer

In OS X you can use ls -lU, stat -f%B, GetFileInfo -d, or mdls -n kMDItemFSCreationDate:

$ ls -lU
total 0
-rw-r--r--  1 lauri  staff  0 Apr 25 03:58 a
$ stat -f%B a
1398387538
$ stat -f%SB -t %Y%m%d%H%M a
201404250358
$ GetFileInfo -d a
04/25/2014 03:58:58
$ mdls -n kMDItemFSCreationDate a
kMDItemFSCreationDate = 2014-04-25 00:58:58 +0000
share|improve this answer

In ext4 it is possible; because ext4 file-system store the file creation time. But still you will find that the stat command is unable to show the date, this is because I think the kernel is still not having any APIs for the same.

Anyway the file birth time is stored in ext4 and you can find it out, although not a direct method, but using debugfs

sudo debugfs -R "stat /ABSOLUTE/PATH" /dev/sdxX | grep crtime

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.