How to get file creation time in Linux ?

As we have seen in this post how to get atime, mtime and ctime of a file.

Lets see how to get crtime or file creation time in Linux.

1. Get Inode number of the file whose creation time we want to know.

### Using ls command
[root@nglinux ~]# ls -i file1
917831 file1

### Using stat command
[root@nglinux ~]# stat -c %i file1
[root@nglinux ~]# 

2. Get partition information on which this file exists.

[root@nglinux ~]# df -h .
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G  9.5G  9.2G  51% /
[root@nglinux ~]# 

3. Now get the file creation time for this inode number that exists on /dev/sda1 partition.

[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1 | grep ^crtime
debugfs 1.41.12 (17-May-2010)
crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018

By this way, using debugfs alongwith stat, we can get the file creation time on Linux.

If you look at the complete output of debugfs command, it shows all file metadata including
a. if ACL is setup.
b. How many blocks.
c. atime, mtime & ctime
d. selinux status
e. Permissions ### Mode : 0644

[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1
debugfs 1.41.12 (17-May-2010)
Inode: 917831   Type: regular    Mode:  0644   Flags: 0x80010
Generation: 1214074103    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 6
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5a570e34:5eaa5d98 -- Wed Jan 10 23:11:48 2018
 atime: 0x5a570dc0:93d53684 -- Wed Jan 10 23:09:52 2018
 mtime: 0x5a570b74:dc8d0180 -- Wed Jan 10 23:00:04 2018
crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018
Size of extra inode fields: 28
Extended attributes stored in inode body: 
  selinux = "unconfined_u:object_r:admin_home_t:s0\000" (38)
(0): 3706379
[root@nglinux ~]#

Store the above command, it is very useful to get all metadata details about any file in linux.

We will look deep into stat and debugfs command in our next article(s).

Stay updated with, subscribe to our blog here.

0 0 votes
Article Rating
Notify of

Oldest Most Voted
Inline Feedbacks
View all comments
3 years ago

Hi sahil,

can you paste params command output below.

debugfs: params
Open mode: read-write
Filesystem in use: /dev/sda1

3 years ago

It is not working,
#debugfs -R ‘stat 541214’ /dev/mapper/rhel-var
debugfs 1.45.6 (20-Mar-2020)
debugfs: Bad magic number in super-block while trying to open /dev/mapper/rhel-var
/dev/mapper/rhel-var contains a xfs file system
stat: Filesystem not open