stat
& debugfs
-R
flag causes debugfs to execute a single command. In our case that command is stat
which is used to check file status. We need to run debugfs where our filesystem is mounted, i.e /dev/sda1
.Note: this will not work on older file systems. Although this has changed with modern file systems such as ext4 & Btrfs which has been designed to store file creation time.