19

i am using ubuntu and want to know the creation time of a file even when it gets modified or accessed ?

Thariama
  • 50,002
  • 13
  • 138
  • 166
fenec
  • 5,637
  • 10
  • 56
  • 82
  • 2
    What file system, ext3 perhaps ? – MSalters Sep 28 '10 at 14:22
  • I just noticed that in ext4 (not sure about other FS), if you list with "ls -li" (to list inodes), it seems to display the creation date. I didn't found any reference to it, so maybe I'm wrong (at least it seems to work for me). – lepe Aug 07 '15 at 05:49

7 Answers7

31

Unfortunately Unix does not store the creation time of a file.

All you are able to get using stat is

  1. time of last access
  2. time of last modification
  3. time of last status change

Note: When using filesystem type ext4 crtime is available!

Thariama
  • 50,002
  • 13
  • 138
  • 166
5

This little script can get the creation date for ext4:

#!/bin/sh

fn=`realpath $1`
echo -n "Querying creation time of $1..."
sudo debugfs -R "stat $fn" /dev/sda4|grep crtime

I named it fcrtime and put it in my ~/bin folder. So in any folder I can use the command like: fcrtime example.odp

Example output:

crtime: 0x5163e3f0:12d6c108 -- Tue Apr 9 12:48:32 2013

Compared to stat-ing the same file:

  File: `example.odp'
  Size: 54962       Blocks: 112        IO Block: 4096   regular file
Device: 804h/2052d  Inode: 11019246    Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/   fulop)   Gid: ( 1000/   fulop)
Access: 2013-04-09 13:20:05.263016001 +0300
Modify: 2013-04-09 13:20:05.227016001 +0300
Change: 2013-04-09 13:20:05.227016001 +0300
 Birth: -

NOTES

  1. realpath is usually not installed by default. In Ubuntu eg. install it with sudo apt-get install realpath
  2. Replace /dev/sda4 if necessary with the one you get from mount|grep ext4
Attila Fulop
  • 6,861
  • 2
  • 44
  • 50
  • realpath does not seem to resolve the location correctly for files in /home if /home is a separate partition. A file named /home/user/fname should be resolved as user/fname. – Rucent88 Mar 06 '14 at 11:26
  • 1
    I don't see `realpath` should do that. It is a utility to convert a filename to an absolute pathname (see `man realpath`). What you're looking for is the filename relative to the partition. I'm not aware of a tool like that but it probably exists out in the wild. – Attila Fulop Mar 06 '14 at 16:06
  • Other than that you're right, my script doesn't work if the target file is on a separate partition – Attila Fulop Mar 06 '14 at 16:08
  • Yes, I was just pointing that out for anyone seeking to use your script. Other than that issue, it works perfect. – Rucent88 Mar 07 '14 at 03:27
3

The closest attribute available is the "change time", also known as ctime. This is updated for various system calls, any that modify the inode, rather than the data it contains.

matt@stanley:~$ stat -c %z .bashrc 
2010-08-17 11:53:56.865431072 +1000

Links

Matt Joiner
  • 112,946
  • 110
  • 377
  • 526
  • @AttilaFulop: Duh. That's why I said "the closest", and go into very specific detail how it differs from the creation time. – Matt Joiner Apr 09 '13 at 10:46
  • ctime is change time, not creation time! The question was about creation time. Change time is absolutely not useful for anyone looking for creation time. – Franklin Piat Mar 20 '15 at 20:28
1

Creation time, is known as file Birth time and is supported on some filesystem, with some kernels only. The command would be Mohsen Pahlevanzadeh answer:

stat --printf='%w' yourfile   #human readable

stat --printf='%W' yourfile   #seconds from Epoch , 0 if unknown

Note: this question is a duplicate of How to find creation date of file?. Also, make sure to read this question What file systems on Linux store the creation time?.

Community
  • 1
  • 1
Franklin Piat
  • 3,952
  • 3
  • 32
  • 45
1

According to http://en.wikipedia.org/wiki/Comparison_of_file_systems, this is available for ext4, btfrs, FAT, NTFS, and UDF filesystems, plus some others you're unlikely to encounter. It's not available on ext2 or ext3, probably the most common file system formats in Ubuntu.

You'll need a kernel patch, though: http://lwn.net/Articles/394391/. Apparently this is because Linus rejected creation time attribute on the grounds that somebody called it an "otime" and somebody else called it a "btime", and therefore the idea must be useless.

MSalters
  • 173,980
  • 10
  • 155
  • 350
-3

Yup - stat(): http://manpages.ubuntu.com/manpages/hardy/man2/stat.2.html

Jeff Meyers
  • 144
  • 5
-3

guys i just finished writing this script this script to find the creation date of a file using perl:

use File::stat;
if (  scalar( @ARGV ) == 0 ) {
 die("type  a file  name  ex:perl filestat.pl <filename>");    
}
my $filename =  $ARGV[0] ;
my @info = stat($filename);
print "Creation time :",scalar localtime stat($filename)->ctime;
print "\n";
fenec
  • 5,637
  • 10
  • 56
  • 82