Today I Learned
Search…
Finding the file creation date/time on Linux
Posted on 18 Dec, 2020

1. Find inode number of file.

1
$ ls -i myfile.md
2
9344160 myfile.md
Copied!

2. Find name of your root partition

1
$ df -h
2
Filesystem Size Used Avail Use% Mounted on
3
udev 924M 0 924M 0% /dev
4
tmpfs 191M 1.4M 190M 1% /run
5
/dev/sda1 146G 38G 101G 28% /
6
tmpfs 954M 121M 833M 13% /dev/shm
7
...
Copied!

3. Use the inode no in stat & debugfs

1
sudo debugfs -R 'stat <9344160>' /dev/sda1
Copied!
Look for crtime, that is our file creation date/time
Here is a one liner if your filesystem is ext4
1
sudo debugfs -R "stat <$(ls -i myfile.md | awk '{ print $1}')>" /dev/sda1 | grep 'crtime'
Copied!
  • debugfs is a ext2, ext3, ext4 file system debugger. The -R flag causes debugfs to execute a single command. In our case that command is stat which is used to check file status. We need to run debugfs where our filesystem is mounted, i.e /dev/sda1.
Note: this will not work on older file systems. Although this has changed with modern file systems such as ext4 & Btrfs which has been designed to store file creation time.