How to get file creation time in Linux ?

As we have seen in this post how to get atime, mtime and ctime of a file.

Lets see how to get crtime or file creation time in Linux.

1. Get Inode number of the file whose creation time we want to know.

### Using ls command
[root@nglinux ~]# ls -i file1
917831 file1

### Using stat command
[root@nglinux ~]# stat -c %i file1
917831
[root@nglinux ~]# 

2. Get partition information on which this file exists.

[root@nglinux ~]# df -h .
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G  9.5G  9.2G  51% /
[root@nglinux ~]# 

3. Now get the file creation time for this inode number that exists on /dev/sda1 partition.

[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1 | grep ^crtime
debugfs 1.41.12 (17-May-2010)
crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018

By this way, using debugfs alongwith stat, we can get the file creation time on Linux.

If you look at the complete output of debugfs command, it shows all file metadata including
a. if ACL is setup.
b. How many blocks.
c. atime, mtime & ctime
d. selinux status
e. Permissions ### Mode : 0644

[root@nglinux ~]# debugfs -R 'stat <917831>' /dev/sda1
debugfs 1.41.12 (17-May-2010)
Inode: 917831   Type: regular    Mode:  0644   Flags: 0x80010
Generation: 1214074103    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 6
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5a570e34:5eaa5d98 -- Wed Jan 10 23:11:48 2018
 atime: 0x5a570dc0:93d53684 -- Wed Jan 10 23:09:52 2018
 mtime: 0x5a570b74:dc8d0180 -- Wed Jan 10 23:00:04 2018
crtime: 0x5a570b14:9041bc14 -- Wed Jan 10 22:58:28 2018
Size of extra inode fields: 28
Extended attributes stored in inode body: 
  selinux = "unconfined_u:object_r:admin_home_t:s0\000" (38)
EXTENTS:
(0): 3706379
[root@nglinux ~]#

Store the above command, it is very useful to get all metadata details about any file in linux.

We will look deep into stat and debugfs command in our next article(s).

Stay updated with NGELinux.com, subscribe to our blog here.