How to get file creation date/time in Bash/Debian?

Question

I'm using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time. ls -lh a.txt and stat -c %y a.txt both only give the modification time.

Solution 1

Unfortunately your quest won't be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in <sys/stat.h>.

EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.

Solution 2

ls -i file #output is for me 68551981
debugfs -R 'stat <68551981>' /dev/sda3 # /dev/sda3 is the disk on which the file exists

#results - crtime value
[root@loft9156 ~]# debugfs -R 'stat <68551981>' /dev/sda3
debugfs 1.41.12 (17-May-2010)
Inode: 68551981   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 769802755    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 38973440
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 76128
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013
 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
**crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013**
Size of extra inode fields: 28
EXTENTS:
(0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144
-9514): 357961728-357965098

Solution 3

mikyra's answer is good.The fact just like what he said.

[jason@rh5 test]$ stat test.txt
  File: `test.txt'
  Size: 0               Blocks: 8          IO Block: 4096   regular empty file
Device: 802h/2050d      Inode: 588720      Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  500/   jason)   Gid: (  500/   jason)
Access: 2013-03-14 01:58:12.000000000 -0700
Modify: 2013-03-14 01:58:12.000000000 -0700
Change: 2013-03-14 01:58:12.000000000 -0700

if you want to verify wich file was created first,you can structure your file name by appending system date when you create a series of files.

Solution 4

Note that if you've got your filesystem mounted with noatime for performance reasons, then the atime will likely show the creation time. Given that noatime results in a massive performance boost (by removing a disk write for every time a file is read), it may be a sensible configuration option that also gives you the results you want.

Solution 5

Creation date/time is normally not stored. So no, you can't.

View more solutions

Comments

[William Pursell]

Are you using a filesystem that records creation time? Most don't.

[John Red]

See askubuntu.com/questions/470134/…

[allyourcode]

When I do stat myfile.txt, I get another row: Birth. Unfortunately, it has no value. Why is that row there?

[mokalan]

ctime is not the creation time, it's the "time of last modification of the file status information"

[Luca Davanzo]

what's the meaning for ctime, atime and mtime?

[indivisible]

@Velthune Creation time, Access time, Modification time. However depending on the way the filesystem is configured these values may or may not be accurate. For instance, many people disable writing last access time to files to save on the extra disk writes.

[ingyhere]

ctime = "change time" where change means modification of owner, group, privileges or some other attribute. It's not necessarily the creation time.

[ingyhere]

@indivisible: FALSE! POSIX standards define ctime as change time. This is when some file attribute changes, generally.

[jake]

I can't vouch for the performance boost, but I read a guide for SSD's that recommended noatime, so this worked for me.

[froggythefrog]

Such sad news. It'd be so useful right now to determine easily whether a file has been deleted and recreated or has been there all along.

[bartgol]

I don't know the standards, but the ctime here is after the atime. I would assume creation time should be the oldest...

[johk95]

Do you know how that works on a Mac? The Finder shows three timestamps as 'Created', 'Modified', 'Last openend'...

[mikyra]

Strongly dependant on the filesystem used. But good point anyways. :)Tried to add the missing information to the post.

[RonJohn]

What's the difference between change time and modification time?

[PJSCopeland]

ctime is the time the directory information was updated; mtime is the time the file itself was updated.

[truf]

It seems ls -l displays Modify time, not Creation or Birth time

[user9074332]

$ /usr/bin/find -newerBt '2014-06-13' /usr/bin/find: This system does not provide a way to find the birth time of a file. /usr/bin/find: invalid predicate -newerBt'`

[MaXi32]

It is a placeholder for another file system that able to store creation date.

[Jesse Chisholm]

Not pleasing to most because it requires sudo and debugfs.

[Alex78191]

@mikyra ext4 stores the creation date.