In this tutorial, we’ll learn various methods to get the file creation date on Linux systems.
2. Why Can’t We Get the Creation Date on Old Systems?
Older systems run old versions of filesystems, which don’t store the file creation date.
As the POSIX standard only specifies three types of timestamps to be stored for a file, there is no requirement for a filesystem to support anything beyond them. These three timestamps store information about:
- Last data access – atime
- Last data modification – mtime
- File status changes – ctime
However, newer filesystems such as ext4, zfs, btrfs, JFS, and XFS do store the creation timestamp in separate fields:
These fields point to data stored in file inodes.
3. Getting the File Creation Date Using stat
The easiest way to get the file creation date is with the stat command.
Let’s create a file and check its creation time:
$ date; echo "Hello" > file Fri Dec 17 11:26:25 IST 2021 $ cat file Hello $ stat file File: file Size: 6 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 +0530 Modify: 2021-12-17 11:26:25.578441510 +0530 Change: 2021-12-17 11:26:25.578441510 +0530 Birth: 2021-12-17 11:26:25.578441510 +0530
As we can see, the creation date is shown in the “Birth” field.
Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time:
$ echo "Modified" >> file $ cat file Hello Modified $ stat file File: file Size: 15 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 +0530 Modify: 2021-12-17 11:28:32.290443553 +0530 Change: 2021-12-17 11:28:32.290443553 +0530 Birth: 2021-12-17 11:26:25.578441510 +0530
We can also instruct stat only to give us the required data, which is the file creation date in our case. For this, we can use the –format flag with %w as its value:
$ stat -c '%w' file 2021-12-17 11:26:25.578441510 +0530
Additionally, there are many other formats, which can be found with stat –help:
$ stat --help ... The valid format sequences for files (without --file-system): ... %U user name of owner %w time of file birth, human-readable; - if unknown %W time of file birth, seconds since Epoch; 0 if unknown %x time of last access, human-readable ...
4. Getting the File Creation Date Using debugfs
We can also use the debugfs command to find the creation date on ext4 filesystems. However, it is not as intuitive as the stat command since its primary purpose is to debug filesystems.
Firstly, we need the inode number of our file. We can find it with the ls command.
The -i flag makes ls print the inode numbers of files:
$ ls -i ./file 5118705 ./file
We also need the filesystem of the file. We can find this with the df command:
~ $ df ./file Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda2 26046564 8380600 16338936 34% /
Now, we can pass this information to the debugfs command. The syntax is debugfs -R ‘stat <inode>’ /dev/sdX where inode is our file inode, and /dev/sdX is the filesystem of the file:
$ sudo debugfs -R 'stat <5118705>' /dev/sda2 debugfs 1.46.4 (18-Aug-2021) Inode: 5118705 Type: regular Mode: 0644 Flags: 0x80000 Generation: 2975709199 Version: 0x00000000:00000001 User: 1000 Group: 1000 Project: 0 Size: 8 File ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 atime: 0x61bc3224:7f8fe250 -- Fri Dec 17 06:45:56 2021 mtime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 crtime: 0x61bc2b65:71f8e150 -- Fri Dec 17 06:17:09 2021 Size of extra inode fields: 32 Inode checksum: 0x5ddd5b4b EXTENTS: (0):5279293
Here, the creation time is in the crtime field mentioned earlier. We can see that we created the file on “Fri Dec 17 06:17:09 2021”.
While the ctime field sounds similar to crtime, it does not tell us the file creation date. It shows us the last time the file status was changed due to modifications such as changing the file permissions.
In this article, we covered the historical reasons for the unavailability of file creation dates, along with the methods to get the creation date on modern systems.