.png%3Falt%3Dmedia%26token%3D27026fbf-37b4-4258-9087-a27d01e36b98)
.png%3Falt%3Dmedia%26token%3D27026fbf-37b4-4258-9087-a27d01e36b98)
Today I Learned
Search…
Career
Coding Practices
Databases
Distributed Computing
Git
Go
Miscellaneous
Python
Shell
Vim
Finding the file creation date/time on Linux
Posted on 18 Dec, 2020
1. Find inode number of file.
1
$ ls -i myfile.md
2
9344160 myfile.md
Copied!
2. Find name of your root partition
1
$ df -h
2
Filesystem Size Used Avail Use% Mounted on
3
udev 924M 0 924M 0% /dev
4
tmpfs 191M 1.4M 190M 1% /run
5
/dev/sda1 146G 38G 101G 28% /
6
tmpfs 954M 121M 833M 13% /dev/shm
7
...
Copied!
3. Use the inode no in stat & debugfs
stat & debugfs1
sudo debugfs -R 'stat <9344160>' /dev/sda1
Copied!
Look for crtime, that is our file creation date/time
Here is a one liner if your filesystem is ext4
1
sudo debugfs -R "stat <$(ls -i myfile.md | awk '{ print $1}')>" /dev/sda1 | grep 'crtime'
Copied!
- debugfs is a ext2, ext3, ext4 file system debugger. The
-Rflag causes debugfs to execute a single command. In our case that command isstatwhich is used to check file status. We need to run debugfs where our filesystem is mounted, i.e/dev/sda1.
Note: this will not work on older file systems. Although this has changed with modern file systems such as ext4 & Btrfs which has been designed to store file creation time.
Copy link
Edit on GitHub