1. Overview

In this tutorial, we’ll learn various methods to get the file creation date on Linux systems.

2. Why Can’t We Get the Creation Date on Old Systems?

Older systems run old versions of filesystems, which don’t store the file creation date.

As the POSIX standard only specifies three types of timestamps to be stored for a file, there is no requirement for a filesystem to support anything beyond them. These three timestamps store information about:

  • Last data access – atime
  • Last data modification – mtime
  • File status changes – ctime

However, newer filesystems such as ext4, zfs, btrfs, JFS, and XFS do store the creation timestamp in separate fields:

  • ext4crtime
  • zfscrtime
  • XFScrtime
  • btrfsotime
  • JFS – di_otime

These fields point to data stored in file inodes.

3. Getting the File Creation Date Using stat

The easiest way to get the file creation date is with the stat command.

Let’s create a file and check its creation time:

$ date; echo "Hello" > file
Fri Dec 17 11:26:25 IST 2021
$ cat file
Hello
$ stat file
  File: file
  Size: 6             Blocks: 8          IO Block: 4096   regular file
Device: 19h/25d    Inode: 1451722     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/baeldung)   Gid: ( 1000/baeldung)
Access: 2021-12-17 11:26:25.578441510 +0530
Modify: 2021-12-17 11:26:25.578441510 +0530
Change: 2021-12-17 11:26:25.578441510 +0530
 Birth: 2021-12-17 11:26:25.578441510 +0530

As we can see, the creation date is shown in the “Birth” field.

Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time:

$ echo "Modified" >> file
$ cat file
Hello
Modified
$ stat file
  File: file
  Size: 15            Blocks: 8          IO Block: 4096   regular file
Device: 19h/25d    Inode: 1451722     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/baeldung)   Gid: ( 1000/baeldung)
Access: 2021-12-17 11:26:25.578441510 +0530
Modify: 2021-12-17 11:28:32.290443553 +0530
Change: 2021-12-17 11:28:32.290443553 +0530
 Birth: 2021-12-17 11:26:25.578441510 +0530

We can also instruct stat only to give us the required data, which is the file creation date in our case. For this, we can use the –format flag with %w as its value:

$ stat -c '%w' file
2021-12-17 11:26:25.578441510 +0530

Additionally, there are many other formats, which can be found with stat –help:

$ stat --help
...
The valid format sequences for files (without --file-system):
...
  %U   user name of owner
  %w   time of file birth, human-readable; - if unknown
  %W   time of file birth, seconds since Epoch; 0 if unknown
  %x   time of last access, human-readable
...

4. Getting the File Creation Date Using debugfs

We can also use the debugfs command to find the creation date on ext4 filesystems. However, it is not as intuitive as the stat command since its primary purpose is to debug filesystems.

Firstly, we need the inode number of our file. We can find it with the ls command.

The -i flag makes ls print the inode numbers of files:

$ ls -i ./file
5118705 ./file

We also need the filesystem of the file. We can find this with the df command:

~ $ df ./file
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda2             26046564   8380600  16338936  34% /

Now, we can pass this information to the debugfs command. The syntax is debugfs -R ‘stat ’ /dev/sdX where inode is our file inode, and /dev/sdX is the filesystem of the file:

$ sudo debugfs -R 'stat <5118705>' /dev/sda2
debugfs 1.46.4 (18-Aug-2021)
Inode: 5118705   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 2975709199    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 8
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021
atime: 0x61bc3224:7f8fe250 -- Fri Dec 17 06:45:56 2021
mtime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021
crtime: 0x61bc2b65:71f8e150 -- Fri Dec 17 06:17:09 2021
Size of extra inode fields: 32
Inode checksum: 0x5ddd5b4b
EXTENTS:
(0):5279293

Here, the creation time is in the crtime field mentioned earlier. We can see that we created the file on “Fri Dec 17 06:17:09 2021”.

While the ctime field sounds similar to crtime, it does not tell us the file creation date. It shows us the last time the file status was changed due to modifications such as changing the file permissions.

5. Conclusion

In this article, we covered the historical reasons for the unavailability of file creation dates, along with the methods to get the creation date on modern systems.