How to find the Linux file creation date?

In the Linux file manager, the properties of a file frequently display only information about the date it was last accessed and the date it was modified. However, there is no date of creation listed. And you may need to look at it from time to time, for example, to determine when the log was created.

In this article, we will explain what data is stored in Linux file systems and how to determine the date of creation of a Linux file. Two convenient methods will be mentioned at the same time, each with their own set of characteristics.

Linux file creation date

The POSIX standard specifies only three types of timestamps that must be stored by the file system:

• atime – the last time the file was accessed.
• mtime – the last time the content was modified.
• ctime – the time when access or owner rights were last modified.

As a result, it is frequently impossible to view information about a file’s creation date in older file systems. However, it is already preserved in modern file systems (ext4, zfs, XFS, and so on).
Data on the date of creation is kept in a separate field:

• Ext4 – crtime
• ZFS – crtime
• XFS – crtime
• btrfs – otime
• JFS – di_otime

This information can be viewed in two ways: with the stat utility and with debugfs. However, the first method is not applicable to all Linux distributions. The second method is more universal, but it is more difficult to apply. Let us deal with them one at a time.

1. WITH STAT

The stat utility displays detailed information about the file. This includes the date the Linux file was created. To run it in the terminal, simply enter the file’s path. Consider the following information about the image pic_1.jpeg stored in the /home/root-user/Pictures directory:

stat /home/root-user/Pictures/pic_1.jpeg

The Created column has all of the essential information. You may also use the -c option to specify formatting constraints for displaying information, such as keeping only the specified column blank:

stat -c '%w' /home/root-user/Pictures/pic_1.jpeg

However, there is an issue. When running the stat program on some Linux systems, this field is left blank.

The problem was that the output of this information was only visible in statx(2). Its wrapper has been introduced to the glibc library in version 2.28. Support for this technique was included to the GNU coreutils 8.31 suite of fundamental system utilities. Run the following command to see what version it is:

stat --version

This implies that stat will only show information on the file’s creation if specific circumstances are met, as explained above. For example, everything works fine in Ubuntu 21.10, while the field is empty in Ubuntu 20.04.

2. USING DEBUGFS

Debugfs, unlike the stat utility discussed in the preceding section, has no such version constraints. As a result, it will always function. However, the technique for employing it is a little more perplexing. This is because, in order to examine the date of creation of a file using debugfs, you must first determine its inode number and file system. Get inode will exit using the ls command and the -i option, giving the file’s path:

ls -i /home/root-user/scripts/main_script.txt

The df command is also useful for viewing the file system:

df /home/root-user/scripts/main_script.txt

Now that you’ve gathered all of the necessary data, you may use the debugfs software. It must include the -R option, the inode number, and the file system name:

sudo debugfs -R 'stat <28>' /dev/sda5

Locate the field in the terminal that stores the creation date. This was noted at the opening of the article. It’s crtime in this circumstance.

A thorough description of what an inode is may be found in a dedicated page on our website.

Conclusions

We looked at two methods for determining the creation date of a Linux file. The stat tool is a little more convenient because it simply requires the path to it. However, it will not provide the essential information until GNU coreutils version 8.31 is installed. In this aspect, debugfs is more flexible, but less user-friendly. After all, obtaining data necessitates providing the file’s inode number and file system.