Today I Learned
Search…
Finding the file creation date/time on Linux
Posted on 18 Dec, 2020

1. Find inode number of file.

$ ls -i myfile.md
9344160 myfile.md

2. Find name of your root partition

$ df -h
Filesystem Size Used Avail Use% Mounted on
udev 924M 0 924M 0% /dev
tmpfs 191M 1.4M 190M 1% /run
/dev/sda1 146G 38G 101G 28% /
tmpfs 954M 121M 833M 13% /dev/shm
...

3. Use the inode no in stat & debugfs

sudo debugfs -R 'stat <9344160>' /dev/sda1
Look for crtime, that is our file creation date/time
Here is a one liner if your filesystem is ext4
sudo debugfs -R "stat <$(ls -i myfile.md | awk '{ print $1}')>" /dev/sda1 | grep 'crtime'
  • debugfs is a ext2, ext3, ext4 file system debugger. The -R flag causes debugfs to execute a single command. In our case that command is stat which is used to check file status. We need to run debugfs where our filesystem is mounted, i.e /dev/sda1.
Note: this will not work on older file systems. Although this has changed with modern file systems such as ext4 & Btrfs which has been designed to store file creation time.
Copy link
Edit on GitHub
On this page
1. Find inode number of file.
2. Find name of your root partition
3. Use the inode no in stat & debugfs