Gfilui

I need to find the creation time of a file, when I read some articles about this issue, all mentioned that there is no solution (like Site1, Site2).

When I tried the stat command, it states Birth: -.

So how can I find the creation time of a file?

There is a way to know the creation date of a directory , just follow these steps :

1. Know the inode of the directory by ls -i command (lets say for example its X)




2. Know on which partition your directory is saved by df -T /path command ( lets say its on /dev/sda1 )




3. Now use this command : sudo debugfs -R 'stat <X>' /dev/sda1

You will see in the output :

crtime: 0x4e81cacc:966104fc -- mon Sep 27 14:38:28 2013

crtime is the creation date of your file .

What I tested :

1. Created a directory at specific time .


2. Accessed it .



3. Modified it by creating a file .




4. I tried the command and it gave an exact time .



5. Then i modify it , and test again , the crtime remained the same ,
   but modify and access time changed .

@Nux found a great solution for this which you should all upvote. I decided to write a little function that can be used to run everything directly. Just add this to your
~/.bashrc.

get_crtime() 
 grep -oP 'crtime.*--s*K.*')
 printf "%st%sn" "$target" "$crtime"
 done

Now, you can run get_crtime to print the creation dates of as many files or directories as you like:

$ get_crtime foo foo/file 
foo Wed May 21 17:11:08 2014
foo/file Wed May 21 17:11:27 2014

The inability of stat to show the creation time is due to limitation of the stat(2) system call, whose return struct didn't include a field for the creation time. Starting with Linux 4.11 (i.e., 17.10 and newer*), however, the new statx(2) system call is available, which does include a creation time in its return struct.

* And possibly on older LTS releases using the hardware enablement stack (HWE) kernels. Check uname -r to see if you are using a kernel at least at 4.11 to confirm.

Unfortunately, it's not easy to call system calls directly in a C program. Typically glibc provides a wrapper that makes the job easy, but glibc hasn't yet added a wrapper for statx(2). Luckily, @whotwagner wrote a sample C program that shows how to use the statx(2) system call on x86 and x86-64 systems. Its output is the same format as stat's default, without any formatting options, but it's simple to modify it to print just the birth time.

First, clone it:

git clone https://github.com/whotwagner/statx-fun

You can compile the statx.c code, or, if you just want the birth time, create a birth.c in the cloned directory with the following code (which is a minimal version of statx.c printing just the creation timestamp including nanosecond precision):

#define _GNU_SOURCE
#define _ATFILE_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
#include <fcntl.h>
#include "statx.h"
#include <time.h>
#include <getopt.h>
#include <string.h>

// does not (yet) provide a wrapper for the statx() system call
#include <sys/syscall.h>

/* this code works ony with x86 and x86_64 */
#if __x86_64__
#define __NR_statx 332
#else
#define __NR_statx 383
#endif

#define statx(a,b,c,d,e) syscall(__NR_statx,(a),(b),(c),(d),(e))

int main(int argc, char *argv)

 int dirfd = AT_FDCWD;
 int flags = AT_SYMLINK_NOFOLLOW;
 unsigned int mask = STATX_ALL;
 struct statx stxbuf;
 long ret = 0;

 int opt = 0;

 while(( opt = getopt(argc, argv, "alfd")) != -1)
 
 switch(opt) 
 case 'a':
 flags 
 

 if (optind >= argc) 
 exit(EXIT_FAILURE);
 

 for (; optind < argc; optind++) 
 memset(&stxbuf, 0xbf, sizeof(stxbuf));
 ret = statx(dirfd, argv[optind], flags, mask, &stxbuf);
 if( ret < 0)
 
 perror("statx");
 return EXIT_FAILURE;
 
 printf("%lld.%un", *&stxbuf.stx_btime.tv_sec, *&stxbuf.stx_btime.tv_nsec);
 
 return EXIT_SUCCESS;

Then:

$ make birth
$ ./birth ./birth.c
1511793291.254337149
$ ./birth ./birth.c | xargs -I date -d @
Mon Nov 27 14:34:51 UTC 2017

In theory this should make the creation time more accessible:

• more filesystems should be supported than just the ext* ones (debugfs is a tool for ext2/3/4 filesystems, and unusable on others)


• you don't need root to use this (except for installing some required packages, like make and linux-libc-dev).

Testing out an xfs system, for example:

$ truncate -s 1G temp; mkfs -t xfs temp; mkdir foo; sudo mount temp foo; sudo chown $USER foo
$ touch foo/bar
$ # some time later
$ echo > foo/bar
$ chmod og-w foo/bar
$ ./birth foo/bar | xargs -I date -d @
Mon Nov 27 14:43:21 UTC 2017
$ stat foo/bar 
 File: foo/bar
 Size: 1 Blocks: 8 IO Block: 4096 regular file
Device: 700h/1792d Inode: 99 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ muru) Gid: ( 1000/ muru)
Access: 2017-11-27 14:43:32.845579010 +0000
Modify: 2017-11-27 14:44:38.809696644 +0000
Change: 2017-11-27 14:44:45.536112317 +0000
 Birth: -

However, this didn't work for NTFS and exfat. I guess the FUSE filesystems for those didn't include the creation time.

If, or rather when, glibc adds support for the statx(2) system call, stat will follow soon and we'll be able to use the plain old stat command for this. But I don't think this will be backported to LTS releases even if they do get newer kernels. So, I don't expect stat on any current release (14.04, 16.04, 17.04, 17.10) to ever print the creation time without manual intervention.

TL;DR:
Just run:
sudo debugfs -R 'stat /path/to/your/file' /dev/<your fs>

(To figure out your fs, run df -T /path/to/your/file, most likely it's going to be /dev/sda1).

Long version:

We are going to run two commands:

1. 
   

   Find out the name of partition name for your file.

   
   
   

   df -T /path/to/your/file
   

   
   
   

   The output is going to look like this (partition name is first):

   
   
   

   Filesystem Type 1K-blocks Used Available Use% Mounted on
   /dev/<your fs> ext4 7251432 3481272 3509836 50% /
   

   
   


2. 
   

   Find out creation time for that file.

   
   
   

   sudo debugfs -R 'stat /path/to/your/file' /dev/<your fs>
   

   
   
   

   In the output, look for ctime.