.png%3Falt%3Dmedia%26token%3D27026fbf-37b4-4258-9087-a27d01e36b98)
.png%3Falt%3Dmedia%26token%3D27026fbf-37b4-4258-9087-a27d01e36b98)
Finding the file creation date/time on Linux
Posted on 18 Dec, 2020
$ ls -i myfile.md
9344160 myfile.md
$ df -h
Filesystem Size Used Avail Use% Mounted on
udev 924M 0 924M 0% /dev
tmpfs 191M 1.4M 190M 1% /run
/dev/sda1 146G 38G 101G 28% /
tmpfs 954M 121M 833M 13% /dev/shm
...
sudo debugfs -R 'stat <9344160>' /dev/sda1
Look for crtime, that is our file creation date/time
Here is a one liner if your filesystem is ext4
sudo debugfs -R "stat <$(ls -i myfile.md | awk '{ print $1}')>" /dev/sda1 | grep 'crtime'
- debugfs is a ext2, ext3, ext4 file system debugger. The
-Rflag causes debugfs to execute a single command. In our case that command isstatwhich is used to check file status. We need to run debugfs where our filesystem is mounted, i.e/dev/sda1.
Note: this will not work on older file systems. Although this has changed with modern file systems such as ext4 & Btrfs which has been designed to store file creation time.