1. Overview
In this tutorial, we’ll learn various methods to get the file creation date on Linux systems.
2. Why Can’t We Get the Creation Date on Old Systems?
Older systems run old versions of filesystems, which don’t store the file creation date.
As the POSIX standard only specifies three types of timestamps to be stored for a file, there is no requirement for a filesystem to support anything beyond them. These three timestamps store information about:
- Last data access – atime
- Last data modification – mtime
- File status changes – ctime
However, newer filesystems such as ext4, zfs, btrfs, JFS, and XFS do store the creation timestamp in separate fields:
These fields point to data stored in file inodes.
3. Getting the File Creation Date Using stat
The easiest way to get the file creation date is with the stat command.
Let’s create a file and check its creation time:
$ date; echo "Hello" > file
Fri Dec 17 11:26:25 IST 2021
$ cat file
Hello
$ stat file
File: file
Size: 6 Blocks: 8 IO Block: 4096 regular file
Device: 19h/25d Inode: 1451722 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung)
Access: 2021-12-17 11:26:25.578441510 +0530
Modify: 2021-12-17 11:26:25.578441510 +0530
Change: 2021-12-17 11:26:25.578441510 +0530
Birth: 2021-12-17 11:26:25.578441510 +0530
As we can see, the creation date is shown in the “Birth” field.
Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time:
$ echo "Modified" >> file
$ cat file
Hello
Modified
$ stat file
File: file
Size: 15 Blocks: 8 IO Block: 4096 regular file
Device: 19h/25d Inode: 1451722 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung)
Access: 2021-12-17 11:26:25.578441510 +0530
Modify: 2021-12-17 11:28:32.290443553 +0530
Change: 2021-12-17 11:28:32.290443553 +0530
Birth: 2021-12-17 11:26:25.578441510 +0530
We can also instruct stat only to give us the required data, which is the file creation date in our case. For this, we can use the –format flag with %w as its value:
$ stat -c '%w' file
2021-12-17 11:26:25.578441510 +0530
Additionally, there are many other formats, which can be found with stat –help:
$ stat --help
...
The valid format sequences for files (without --file-system):
...
%U user name of owner
%w time of file birth, human-readable; - if unknown
%W time of file birth, seconds since Epoch; 0 if unknown
%x time of last access, human-readable
...
4. Getting the File Creation Date Using debugfs
We can also use the debugfs command to find the creation date on ext4 filesystems. However, it is not as intuitive as the stat command since its primary purpose is to debug filesystems.
Firstly, we need the inode number of our file. We can find it with the ls command.
The -i flag makes ls print the inode numbers of files:
$ ls -i ./file
5118705 ./file
We also need the filesystem of the file. We can find this with the df command:
~ $ df ./file
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda2 26046564 8380600 16338936 34% /
Now, we can pass this information to the debugfs command. The syntax is debugfs -R ‘stat
$ sudo debugfs -R 'stat <5118705>' /dev/sda2
debugfs 1.46.4 (18-Aug-2021)
Inode: 5118705 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2975709199 Version: 0x00000000:00000001
User: 1000 Group: 1000 Project: 0 Size: 8
File ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021
atime: 0x61bc3224:7f8fe250 -- Fri Dec 17 06:45:56 2021
mtime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021
crtime: 0x61bc2b65:71f8e150 -- Fri Dec 17 06:17:09 2021
Size of extra inode fields: 32
Inode checksum: 0x5ddd5b4b
EXTENTS:
(0):5279293
Here, the creation time is in the crtime field mentioned earlier. We can see that we created the file on “Fri Dec 17 06:17:09 2021”.
While the ctime field sounds similar to crtime, it does not tell us the file creation date. It shows us the last time the file status was changed due to modifications such as changing the file permissions.
5. Conclusion
In this article, we covered the historical reasons for the unavailability of file creation dates, along with the methods to get the creation date on modern systems.