Get file creation time on Linux with EXT4
30 Jan 2015
Despite the common opinion
Linux offers three timestamps for files: time of last access of contents (atime), time of last modification of contents (mtime), and time of last modification of the inode (metadata, ctime).
You may recover the file creation date if you deal with capble filesystem like
EXT4 - journaling file system for Linux:
… Ext4 provides timestamps measured in nanoseconds. In addition, ext4 also adds support for date-created timestamps.
But there no consensus in the community on that so
Theodore Ts’o points out, while it is easy to add an extra creation-date field in the inode (thus technically enabling support for date-created timestamps in ext4), it is more difficult to modify or add the necessary system calls, like stat() (which would probably require a new version) and the various libraries that depend on them (like glibc). These changes would require coordination of many projects. So even if ext4 developers implement initial support for creation-date timestamps, this feature will not be available to user programs for now.
Which end up with
the Linus final quote
Let’s wait five years and see if there is actually any consensus on it being needed and used at all, rather than rush into something just because “we can”.
So what to do? Let’s chill out
Now let’s question yourself how would you extract this information? We end up with the
stat - display file or file system status
Display file or file system status.
debugfs - ext2/ext3/ext4 file system debugger
[ -Vwci ] [ -b blocksize ] [ -s superblock ] [ -f cmd_file ] [ -R request ] [ -d data_source_device ] [ device ]
The debugfs program is an interactive file system debugger. It can be used to examine and change the state of an ext2, ext3, or ext4 file system.
device is the special file corresponding to the device containing the file system (e.g /dev/hdXX ).
So we compound both command in one
$ debugfs -R 'stat <filename>' </dev/sdXX - partition name>
to finally get the
crtime - creation time:
Inode: 1071162 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1324300925 Version: 0x00000000:00000001
User: 105 Group: 114 Size: 1831803
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 3592
Fragment: Address: 0 Number: 0 Size: 0
-- Fri Jan 30 16:16:16 2015
atime: 0x54cba167:94c3cfa0 -- Fri Jan 30 16:21:11 2015
mtime: 0x54cba040:2718d1c8 -- Fri Jan 30 16:16:16 2015
crtime: 0x54ca6763:94c3c518 -- Thu Jan 29 18:01:23 2015
Size of extra inode fields: 28
(0 ): 4229445, (1-7 ): 4261097-4261103, ...
So lets write the
before the consensus will come :)
now put it in
~/.profile and voilà:
$ xstat *
Tue Jan 13 17:41:05 2015 404.html
Thu Feb 5 23:19:19 2015 about.md
Sun Jan 18 01:28:51 2015 archives.html
Tue Jan 13 17:41:05 2015 atom.xml
Thu Feb 5 22:32:52 2015 categories.html
Thu Feb 5 23:24:40 2015 _config.yml
Tue Jan 13 17:41:05 2015 _drafts
Thu Feb 5 21:50:47 2015 Gemfile
Thu Feb 5 21:50:47 2015 Gemfile.lock
Tue Jan 13 17:41:05 2015 _includes
Tue Jan 13 17:41:05 2015 index.html
Tue Jan 13 17:41:05 2015 _layouts
Tue Feb 3 22:42:06 2015 learning-nosql-php.html
Tue Jan 13 17:41:05 2015 LICENSE.md
Thu Feb 5 20:36:30 2015 plugins
Tue Jan 13 17:41:05 2015 _posts
Tue Jan 13 17:41:05 2015 public
Tue Jan 13 17:41:05 2015 README.md
Tue Jan 13 17:41:05 2015 search
Wed Jan 14 20:08:17 2015 _site
Thu Feb 5 22:51:27 2015 tags.html