Get file creation time on Linux with EXT4^edit

30 Jan 2015

8 mins

Despite the common opinion unix.stackexchange.com/get-file-created-creation-time

Linux offers three timestamps for files: time of last access of contents (atime), time of last modification of contents (mtime), and time of last modification of the inode (metadata, ctime).

You may recover the file creation date if you deal with capble filesystem like EXT4 - journaling file system for Linux:

Improved timestamps

… Ext4 provides timestamps measured in nanoseconds. In addition, ext4 also adds support for date-created timestamps.

But there no consensus in the community on that so

… as Theodore Ts’o points out, while it is easy to add an extra creation-date field in the inode (thus technically enabling support for date-created timestamps in ext4), it is more difficult to modify or add the necessary system calls, like stat() (which would probably require a new version) and the various libraries that depend on them (like glibc). These changes would require coordination of many projects. So even if ext4 developers implement initial support for creation-date timestamps, this feature will not be available to user programs for now.

Which end up with the Linus final quote

Let’s wait five years and see if there is actually any consensus on it being needed and used at all, rather than rush into something just because “we can”.

So what to do? Let’s chill out

Now let’s question yourself how would you extract this information? We end up with the STAT utility

NAME
      stat - display file or file system status

SYNOPSIS
       stat [OPTION]... FILE...

DESCRIPTION
       Display file or file system status.

and DEBUGFS utilities

NAME
       debugfs - ext2/ext3/ext4 file system debugger

SYNOPSIS
       debugfs [ -Vwci ] [ -b blocksize ] [ -s superblock ] [ -f cmd_file ] [ -R request ] [ -d data_source_device ] [ device ]

DESCRIPTION
       The debugfs program is an interactive file system debugger. It can be used to examine and change the state of an ext2, ext3, or ext4 file system.
       device is the special file corresponding to the device containing the file system (e.g /dev/hdXX).

So we compound both command in one

$ debugfs -R 'stat <filename>' </dev/sdXX - partition name>

to finally get the crtime - creation time:

Inode: 1071162   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 1324300925    Version: 0x00000000:00000001
User:   105   Group:   114   Size: 1831803
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 3592
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x54cba040:2718d1c8 -- Fri Jan 30 16:16:16 2015
 atime: 0x54cba167:94c3cfa0 -- Fri Jan 30 16:21:11 2015
 mtime: 0x54cba040:2718d1c8 -- Fri Jan 30 16:16:16 2015
 crtime: 0x54ca6763:94c3c518 -- Thu Jan 29 18:01:23 2015
Size of extra inode fields: 28
EXTENTS:
(0): 4229445, (1-7): 4261097-4261103, ...

So lets write the xstat utility before the consensus will come :)

now put it in ~/.bashrc or ~/.profile and voilà:

$ xstat *
Tue Jan 13 17:41:05 2015	404.html
Thu Feb  5 23:19:19 2015	about.md
Sun Jan 18 01:28:51 2015	archives.html
Tue Jan 13 17:41:05 2015	atom.xml
Thu Feb  5 22:32:52 2015	categories.html
Thu Feb  5 23:24:40 2015	_config.yml
Tue Jan 13 17:41:05 2015	_drafts
Thu Feb  5 21:50:47 2015	Gemfile
Thu Feb  5 21:50:47 2015	Gemfile.lock
Tue Jan 13 17:41:05 2015	_includes
Tue Jan 13 17:41:05 2015	index.html
Tue Jan 13 17:41:05 2015	_layouts
Tue Feb  3 22:42:06 2015	learning-nosql-php.html
Tue Jan 13 17:41:05 2015	LICENSE.md
Thu Feb  5 20:36:30 2015	plugins
Tue Jan 13 17:41:05 2015	_posts
Tue Jan 13 17:41:05 2015	public
Tue Jan 13 17:41:05 2015	README.md
Tue Jan 13 17:41:05 2015	search
Wed Jan 14 20:08:17 2015	_site
Thu Feb  5 22:51:27 2015	tags.html