File Creation Time in Linux

Actually, the creation time of any inode is(was) not stored anywhere. I wonder why they did that. Normally we get to see only the following :

ctime - change time
mtime - modification time
atime - access time

What about crtime - creation time?

But things have changed now. We can get the file creation time if your filesystem type is ext4.

First lets see how we can get the details of a file. There is a command called "stat" - display file or filesystem status.

Code:

root@bt > stat somefile
File: `somefile'
Size: 149        Blocks: 8          IO Block: 4096   regular file
Device: 804h/2052d Inode: 211582      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-01-01 20:21:15.276575811 +0530
Modify: 2012-01-01 20:21:14.256570755 +0530
Change: 2012-01-01 20:21:14.256570755 +0530

"somefile" is a normal ascii file. A "stat" on the file will give you all these details. You can also customize the output. Let us say you just want the size of the file.

Code:

root@bt > ls -lrt somefile
-rw-r--r-- 1 root root 149 2012-01-01 20:21 somefile
root@bt > stat -c %s somefile
149

-f will give you information about the file system.

Code:

root@bt > stat -f /dev/sda4
File: "/dev/sda4"
  ID: 0        Namelen: 255     Type: tmpfs
Block size: 4096       Fundamental block size: 4096
Blocks: Total: 255610     Free: 255524     Available: 255524
Inodes: Total: 214563     Free: 213660

Now, the -t option is interesting. If you want to get all this info in one line, use this option. This will be very helpful when it comes to scripts where we use stat to get various information into a variable and do some calculation etc.

Code:

root@bt > stat -t -f /dev/sda4
/dev/sda4 0 255 1021994 4096 4096 255610 255524 255524 214563 213660

So, we didn't get the file creation time yet! What do we do for that?
Ok, here it is
1. You will need a ext4 filesystem.
2. You will also need the debugfs -ext2/ext3/ext4 file system debugger utility which is normally available with any distros. If you don't have it, then simply install it.

Check List
Lets get some info on / and /dev/sda4.

Code:

root@bt > df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda4              14G   10G  2.6G  80% /
none                  999M  344K  999M   1% /dev

Code:

root@bt > mount | grep sda4
/dev/sda4 on / type ext4 (rw,errors=remount-ro)

Cool! It is on ext4.

Once you have all that, then all you have to do is run the following command

Code:

root@bt >  debugfs -R 'stat /root/Desktop/somefile' /dev/sda4
debugfs 1.41.11 (14-Mar-2010)
Inode: 211582   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 1690641204    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 149
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x4f0072e2:3d2bd60c -- Sun Jan  1 20:21:14 2012
atime: 0x4f0072e3:41f0d90c -- Sun Jan  1 20:21:15 2012
mtime: 0x4f0072e2:3d2bd60c -- Sun Jan  1 20:21:14 2012
crtime: 0x4f0072e2:3d2bd60c -- Sun Jan  1 20:21:14 2012
Size of extra inode fields: 28
EXTENTS:
(0): 772301
(END)

Do you see the crtime? Wow!