98

I'm using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time. ls -lh a.txt and stat -c %y a.txt both only give the modification time.

NoodleFolk
  • 1,949
  • 1
  • 15
  • 24

13 Answers13

95

Unfortunately your quest won't be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in <sys/stat.h>.

EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.

mikyra
  • 10,077
  • 1
  • 40
  • 41
46
ls -i file #output is for me 68551981
debugfs -R 'stat <68551981>' /dev/sda3 # /dev/sda3 is the disk on which the file exists

#results - crtime value
[root@loft9156 ~]# debugfs -R 'stat <68551981>' /dev/sda3
debugfs 1.41.12 (17-May-2010)
Inode: 68551981   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 769802755    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 38973440
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 76128
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013
 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
**crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013**
Size of extra inode fields: 28
EXTENTS:
(0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144
-9514): 357961728-357965098
Dmitry Pashkevich
  • 13,431
  • 9
  • 55
  • 73
user2725883
  • 499
  • 4
  • 4
  • 5
    what's the meaning for ctime, atime and mtime? – Luca Davanzo Feb 21 '14 at 15:30
  • 1
    @Velthune Creation time, Access time, Modification time. However depending on the way the filesystem is configured these values may or may not be accurate. For instance, many people disable writing last access time to files to save on the extra disk writes. – indivisible May 09 '14 at 06:37
  • 19
    @indivisible: FALSE! POSIX standards define ctime as change time. This is when some file attribute changes, generally. – ingyhere Oct 01 '14 at 01:38
  • I don't know the standards, but the ctime here is after the atime. I would assume creation time should be the oldest... – bartgol Mar 02 '15 at 14:57
  • 2
    What's the difference between change time and modification time? – RonJohn Dec 03 '17 at 23:11
  • `ctime` is the time the directory information was updated; `mtime` is the time the file itself was updated. – PJSCopeland Feb 19 '18 at 00:18
  • This is interesting - but why not just call `stat $NAME_AND_PATH_OF_FILE` directly, instead of using `debugfs -R` to invoke `stat`? – AJM Aug 17 '22 at 13:02
  • And I didn't know `stat` could take the file's inode in `<` `>` as an input - as far as I can tell when testing with Git Bash on Windows, it can't! I have to use the filename/path instead. – AJM Aug 17 '22 at 13:03
30

mikyra's answer is good. The fact just like what he said.

[jason@rh5 test]$ stat test.txt
  File: `test.txt'
  Size: 0               Blocks: 8          IO Block: 4096   regular empty file
Device: 802h/2050d      Inode: 588720      Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  500/   jason)   Gid: (  500/   jason)
Access: 2013-03-14 01:58:12.000000000 -0700
Modify: 2013-03-14 01:58:12.000000000 -0700
Change: 2013-03-14 01:58:12.000000000 -0700

if you want to verify, which file was created first, you can structure your file name by appending system date when you create a series of files.

Cadoiz
  • 1,446
  • 21
  • 31
jason
  • 431
  • 1
  • 4
  • 5
  • 10
    When I do stat myfile.txt, I get another row: Birth. Unfortunately, it has no value. Why is that row there? – allyourcode Oct 22 '13 at 19:19
  • It is a placeholder for another file system that able to store creation date. – MaXi32 Dec 09 '20 at 16:32
  • I get a "Birth" row as well. This is with Git Bash on Windows 10, so I think the filesystem would be NTFS. – AJM Aug 17 '22 at 12:31
17

Note that if you've got your filesystem mounted with noatime for performance reasons, then the atime will likely show the creation time. Given that noatime results in a massive performance boost (by removing a disk write for every time a file is read), it may be a sensible configuration option that also gives you the results you want.

unit3
  • 271
  • 1
  • 2
  • 1
    I can't vouch for the performance boost, but I read a guide for SSD's that recommended noatime, so this worked for me. – jake Dec 13 '14 at 13:42
7

Creation date/time is normally not stored. So no, you can't.

7

You can find creation time - aka birth time - using stat and also match using find.
We have these files showing last modified time: 

$ ls -l --time-style=long-iso | sort -k6
total 692
-rwxrwx---+ 1 XXXX XXXX 249159 2013-05-31 14:47 Getting Started.pdf
-rwxrwx---+ 1 XXXX XXXX 275799 2013-12-30 21:12 TheScienceofGettingRich.pdf
-rwxrwx---+ 1 XXXX XXXX  25600 2015-05-07 18:52 Thumbs.db
-rwxrwx---+ 1 XXXX XXXX 148051 2015-05-07 18:55 AsAManThinketh.pdf

To find files created within a certain time frame using find as below.
Clearly, the filesystem knows about the birth time of a file: 

$ find -newerBt '2014-06-13' ! -newerBt '2014-06-13 12:16:10' -ls 
20547673299906851  148 -rwxrwx---   1 XXXX XXXX   148051 May  7 18:55 ./AsAManThinketh.pdf
1407374883582246  244 -rwxrwx---   1 XXXX XXXX   249159 May 31  2013 ./Getting\ Started.pdf


We can confirm this using stat: 

$ stat -c "%w %n" * | sort
2014-06-13 12:16:03.873778400 +0100 AsAManThinketh.pdf
2014-06-13 12:16:04.006872500 +0100 Getting Started.pdf
2014-06-13 12:16:29.607075500 +0100 TheScienceofGettingRich.pdf
2015-05-07 18:32:26.938446200 +0100 Thumbs.db


stat man pages explains %w:

%w     time of file birth, human-readable; - if unknown
zanfilip
  • 101
  • 1
  • 1
  • It seems `ls -l` displays Modify time, not Creation or Birth time – truf Mar 06 '19 at 20:21
  • 1
    `$ /usr/bin/find -newerBt '2014-06-13' /usr/bin/find: This system does not provide a way to find the birth time of a file. /usr/bin/find: invalid predicate `-newerBt'` – user9074332 Jul 19 '19 at 02:53
5

ls -i menus.xml

94490 menus.xml Here the number 94490 represents inode

Then do a:

df -h

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg-root   4.0G  3.4G  408M  90% /
tmpfs                 1.9G     0  1.9G   0% /dev/shm
/dev/sda1             124M   27M   92M  23% /boot
/dev/mapper/vg-var    7.9G  1.1G  6.5G  15% /var

To find the mounting point of the root "/" filesystem, because the file menus.xml is on '/' that is '/dev/mapper/vg-root'

debugfs -R 'stat <94490>' /dev/mapper/vg-root

The output may be like the one below:

debugfs -R 'stat <94490>' /dev/mapper/vg-root

debugfs 1.41.12 (17-May-2010)
Inode: 94490   Type: regular    Mode:  0644   Flags: 0x0
Generation: 2826123170    Version: 0x00000000
User:     0   Group:     0   Size: 4441
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 16
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
atime: 0x5266e47b -- Wed Oct 23 09:47:55 2013
mtime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
Size of extra inode fields: 4
Extended attributes stored in inode body: 
  selinux = "unconfined_u:object_r:usr_t:s0\000" (31)
BLOCKS:
(0-1):375818-375819
TOTAL: 2

Where you can see the creation time:

ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
GustavoH
  • 240
  • 2
  • 9
  • 20
    ctime is not the creation time, it's the "time of last modification of the file status information" – mokalan Oct 27 '13 at 10:14
  • 5
    ctime = "change time" where change means modification of owner, group, privileges or some other attribute. It's not necessarily the creation time. – ingyhere Oct 01 '14 at 01:33
4
stat -c %w a.txt

%w returns the file creation(birth) date if it is available, which is rare.

Here's the link

mariko
  • 119
  • 2
  • 7
  • works for me "However, newer filesystems such as ext4, zfs, btrfs, JFS, and XFS do store the creation timestamp in separate fields:" https://www.baeldung.com/linux/get-file-creation-date – Estatistics Nov 23 '22 at 16:47
2

As @mikyra explained, creation date time is not stored anywhere.

All the methods above are nice, but if you want to quickly get only last modify date, you can type:

ls -lit /path

with -t option you list all file in /path odered by last modify date.

Luca Davanzo
  • 21,000
  • 15
  • 120
  • 146
1

If you really want to achieve that you can use a file watcher like inotifywait.

You watch a directory and you save information about file creations in separate file outside that directory.

while true; do
  change=$(inotifywait -e close_write,moved_to,create .)
  change=${change#./ * }
  if [ "$change" = ".*" ]; then ./scriptToStoreInfoAboutFile; fi
done

As no creation time is stored, you can build your own system based on inotify.

william.eyidi
  • 2,315
  • 4
  • 27
  • 39
1

Cited from https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/131347#131347 , the following shellscript would work to get creation time:

get_crtime() {
   for target in "${@}"; do
       inode=$(stat -c %i "${target}")
       fs=$(df "${target}"  | tail -1 | awk '{print $1}')
       crtime=$(sudo debugfs -R 'stat <'"${inode}"'>' "${fs}" 2>/dev/null | grep -oP 'crtime.*--\s*\K.*')
       printf "%s\t%s\n" "${target}" "${crtime}"
   done
}
Community
  • 1
  • 1
Mike Chen
  • 250
  • 2
  • 4
0

even better:

lsct () 
{ 
    debugfs -R 'stat <'`ls -i "$1" | (read a b;echo -n $a)`'>' `df "$1" | (read a; read a b; echo "$a")` 2> /dev/null | grep --color=auto crtime | ( read a b c d;
    echo $d )
}

lsct /etc

Wed Jul 20 19:25:48 2016

Zibri
  • 9,096
  • 3
  • 52
  • 44
0

Another trick to add to your arsenal is the following:

$ grep -r "Copyright" /<path-to-source-files>/src

Generally speaking, if one changes a file they should claim credit in the “Copyright”. Examine the results for dates, file names, contributors and contact email.

example grep result:

/<path>/src/someobject.h: * Copyright 2007-2012 <creator's name> <creator's email>(at)<some URL>>
Rocky Li
  • 5,641
  • 2
  • 17
  • 33
Axoloti
  • 1