As we have seen in this post how to get atime, mtime and ctime of a file.
Lets see how to get crtime or file creation time in Linux.
1. Get Inode number of the file whose creation time we want to know.
### Using ls command [root@nglinux ~]# ls -i file1 917831 file1 ### Using stat command [root@nglinux ~]# stat -c %i file1 917831 [root@nglinux ~]#
2. Get partition information on which this file exists.
[root@nglinux ~]# df -h . Filesystem Size Used Avail Use% Mounted on /dev/sda1 20G 9.5G 9.2G 51% / [root@nglinux ~]#
3. Now get the file creation time for this inode number that exists on /dev/sda1 partition.
[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1 | grep ^crtime debugfs 1.41.12 (17-May-2010) crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018
By this way, using debugfs alongwith stat, we can get the file creation time on Linux.
If you look at the complete output of debugfs command, it shows all file metadata including
a. if ACL is setup.
b. How many blocks.
c. atime, mtime & ctime
d. selinux status
e. Permissions ### Mode : 0644
[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1 debugfs 1.41.12 (17-May-2010) Inode: 917831 Type: regular Mode: 0644 Flags: 0x80010 Generation: 1214074103 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 6 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5a570e34:5eaa5d98 -- Wed Jan 10 23:11:48 2018 atime: 0x5a570dc0:93d53684 -- Wed Jan 10 23:09:52 2018 mtime: 0x5a570b74:dc8d0180 -- Wed Jan 10 23:00:04 2018 crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "unconfined_u:object_r:admin_home_t:s0\000" (38) EXTENTS: (0): 3706379 [root@nglinux ~]#
Store the above command, it is very useful to get all metadata details about any file in linux.
We will look deep into stat and debugfs command in our next article(s).
Stay updated with NGELinux.com, subscribe to our blog here.