1. OverviewIn this tutorial, we’ll learn various methods to get the file creation date on Linux systems.2. Why Can’t We Get the Creation Date on Old Systems?Older systems run old versions of filesystems, which don’t store the file creation date.As the POSIX standard only specifies three types of timestamps to be stored for a file, there is no requirement for a filesystem to support anything beyond them. These three timestamps store information about:Last data access –atimeLast data modification –mtimeFile status changes –ctimeHowever, newer filesystems such asext4,zfs,btrfs,JFS,andXFSdo store the creation timestamp in separate fields:ext4 –crtimezfs –crtimeXFS –crtimebtrfs –otimeJFS –di_otimeThese fields point to data stored in file inodes.3. Getting the File Creation Date UsingstatThe easiest way to get the file creation date is with the stat command.Let’s create a file and check its creation time:$ date; echo Hello file Fri Dec 17 11:26:25 IST 2021 $ cat file Hello $ stat file File: file Size: 6 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 0530 Modify: 2021-12-17 11:26:25.578441510 0530 Change: 2021-12-17 11:26:25.578441510 0530 Birth: 2021-12-17 11:26:25.578441510 0530CopyAs we can see, the creation date is shown in the “Birth” field.Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time:$ echo Modified file $ cat file Hello Modified $ stat file File: file Size: 15 Blocks: 8 IO Block: 4096 regular file Device: 19h/25d Inode: 1451722 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung) Access: 2021-12-17 11:26:25.578441510 0530 Modify: 2021-12-17 11:28:32.290443553 0530 Change: 2021-12-17 11:28:32.290443553 0530 Birth: 2021-12-17 11:26:25.578441510 0530CopyWe can also instructstatonly to give us the required data, which is the file creation date in our case.For this, we can use the–formatflag with%was its value:$ stat -c %w file 2021-12-17 11:26:25.578441510 0530CopyAdditionally, there are many other formats, which can be found withstat –help:$ stat --help ... The valid format sequences for files (without --file-system): ... %U user name of owner %w time of file birth, human-readable; - if unknown %W time of file birth, seconds since Epoch; 0 if unknown %x time of last access, human-readable ...Copy4. Getting the File Creation Date UsingdebugfsWe can also use the debugfs command to find the creation date on ext4 filesystems. However, it is not as intuitive as thestatcommand since its primary purpose is to debug filesystems.Firstly, we need the inode number of our file. We can find it with the ls command.The-iflag makeslsprint the inode numbers of files:$ ls -i ./file 5118705 ./fileCopyWe also need the filesystem of the file. We can find this with the df command:~ $ df ./file Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda2 26046564 8380600 16338936 34% /CopyNow, we can pass this information to thedebugfscommand.The syntax isdebugfs -R ‘stat inode’ /dev/sdXwhereinodeis our file inode, and/dev/sdXis the filesystem of the file:$ sudo debugfs -R stat 5118705 /dev/sda2 debugfs 1.46.4 (18-Aug-2021) Inode: 5118705 Type: regular Mode: 0644 Flags: 0x80000 Generation: 2975709199 Version: 0x00000000:00000001 User: 1000 Group: 1000 Project: 0 Size: 8 File ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 atime: 0x61bc3224:7f8fe250 -- Fri Dec 17 06:45:56 2021 mtime: 0x61bc31c8:19fee850 -- Fri Dec 17 06:44:24 2021 crtime: 0x61bc2b65:71f8e150 -- Fri Dec 17 06:17:09 2021 Size of extra inode fields: 32 Inode checksum: 0x5ddd5b4b EXTENTS: (0):5279293CopyHere, the creation time is in thecrtimefield mentioned earlier. We can see that we created the file on“Fri Dec 17 06:17:09 2021”.While thectimefield sounds similar tocrtime,it does not tell us the file creation date. It shows us the last time the file status was changed due to modifications such as changing the file permissions.5. ConclusionIn this article, we covered the historical reasons for the unavailability of file creation dates, along with the methods to get the creation date on modern systems.
