How to get file creation date / time in Bash / Debian?

Question

I am using Bash on Debian GNU / Linux 6.0. Can I get the file creation date / time? Not the date and time of the change. ls -lh a.txt and stat -c %y a.txt both give modification time.

Answer 1

Unfortunately, your quest will not be possible at all, since for each of your files there are only 3 different times, as defined by the POSIX standard (see the Basic Definitions section 4.8 Updating the time file )

Each file has three different related labels: the time the data was last accessed, the time the data was last modified, and the time the file status was changed. These values ​​are returned in the struct stat characteristics structure file, as described in <sys / stat.h> .

EDIT: as indicated in the comments below, depending on the file system used, metadata may contain the date the file was created. Please note, however, the storage of such information is not standard. Depending on this, there may be a problem with portability moving to another file system, if it is actually used, one way or another, saves it.

Answer 2

 ls -i file #output is for me 68551981 debugfs -R 'stat <68551981>' /dev/sda3 # /dev/sda3 is the disk on which the file exists #results - crtime value [root@loft9156 ~]# debugfs -R 'stat <68551981>' /dev/sda3 debugfs 1.41.12 (17-May-2010) Inode: 68551981 Type: regular Mode: 0644 Flags: 0x80000 Generation: 769802755 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 38973440 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 76128 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013 mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013 **crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013** Size of extra inode fields: 28 EXTENTS: (0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144 -9514): 357961728-357965098 

Answer 3

Note that if you have a file system with noatime installed for performance reasons, then atime will most likely show the creation time. Considering that noatime leads to a significant increase in performance (by deleting the write to disk every time the file is read), this may be a reasonable configuration option that also gives you the desired results.

Answer 4

Mikyra's answer is a good fact. Just like he said.

 [jason@rh5 test]$ stat test.txt File: `test.txt' Size: 0 Blocks: 8 IO Block: 4096 regular empty file Device: 802h/2050d Inode: 588720 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 500/ jason) Gid: ( 500/ jason) Access: 2013-03-14 01:58:12.000000000 -0700 Modify: 2013-03-14 01:58:12.000000000 -0700 Change: 2013-03-14 01:58:12.000000000 -0700 

if you want to first check which file was created, you can structure your file name by adding a system date when creating a series of files.

Answer 5

Creation date / time is usually not . So no, you cannot.

Answer 6

ls -i menus.xml

94490 menus.xml Here, the number 94490 represents inode

Then do a:

df -h

 Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg-root 4.0G 3.4G 408M 90% / tmpfs 1.9G 0 1.9G 0% /dev/shm /dev/sda1 124M 27M 92M 23% /boot /dev/mapper/vg-var 7.9G 1.1G 6.5G 15% /var 

To find the mount point of the root file system "/", since the menus.xml file is located in '/', which is / dev / mapper / vg-root

debugfs -R 'stat <94490>' / dev / mapper / vg-root

The output might look like this:

debugfs -R 'stat <94490>' / dev / mapper / vg-root

 debugfs 1.41.12 (17-May-2010) Inode: 94490 Type: regular Mode: 0644 Flags: 0x0 Generation: 2826123170 Version: 0x00000000 User: 0 Group: 0 Size: 4441 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 16 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013 atime: 0x5266e47b -- Wed Oct 23 09:47:55 2013 mtime: 0x5266e438 -- Wed Oct 23 09:46:48 2013 Size of extra inode fields: 4 Extended attributes stored in inode body: selinux = "unconfined_u:object_r:usr_t:s0\000" (31) BLOCKS: (0-1):375818-375819 TOTAL: 2 

Where you can see the creation time:

 ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013 

Answer 7

As @mikyra explained, creation time is not saved anywhere.

All of the above methods are good, but if you want to quickly get only the latest change date, you can enter:

 ls -lit /path 

with the -t option, you list the entire file in the / path received by the last modified date.

Answer 8

If you really want to achieve this, you can use a file watcher, such as inotifywait .

You look at the directory and save the file creation information in a separate file outside this directory.

 while true; do change=$(inotifywait -e close_write,moved_to,create .) change=${change#./ * } if [ "$change" = ".*" ]; then ./scriptToStoreInfoAboutFile; fi done 

Since the creation time is not saved, you can create your own system based on inotify.

Answer 9

You can find the creation time - otherwise the time of birth - using stat, as well as matching using find.
We have these files with the last modified time:

 $ ls -l --time-style=long-iso | sort -k6 total 692 -rwxrwx---+ 1 XXXX XXXX 249159 2013-05-31 14:47 Getting Started.pdf -rwxrwx---+ 1 XXXX XXXX 275799 2013-12-30 21:12 TheScienceofGettingRich.pdf -rwxrwx---+ 1 XXXX XXXX 25600 2015-05-07 18:52 Thumbs.db -rwxrwx---+ 1 XXXX XXXX 148051 2015-05-07 18:55 AsAManThinketh.pdf 

To find files created over a period of time, use find, as shown below.
Obviously, the file system knows about the time the file was born:

 $ find -newerBt '2014-06-13' ! -newerBt '2014-06-13 12:16:10' -ls 20547673299906851 148 -rwxrwx--- 1 XXXX XXXX 148051 May 7 18:55 ./AsAManThinketh.pdf 1407374883582246 244 -rwxrwx--- 1 XXXX XXXX 249159 May 31 2013 ./Getting\ Started.pdf 

We can confirm this with stat:

 $ stat -c "%w %n" * | sort 2014-06-13 12:16:03.873778400 +0100 AsAManThinketh.pdf 2014-06-13 12:16:04.006872500 +0100 Getting Started.pdf 2014-06-13 12:16:29.607075500 +0100 TheScienceofGettingRich.pdf 2015-05-07 18:32:26.938446200 +0100 Thumbs.db 

stat man pages explain% w:

 %w time of file birth, human-readable; - if unknown 

Answer 10

Quoted from https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/131347#131347 , the following desktop will work to get the creation time:

 get_crtime() { for target in "${@}"; do inode=$(stat -c %i "${target}") fs=$(df "${target}" | tail -1 | awk '{print $1}') crtime=$(sudo debugfs -R 'stat <'"${inode}"'>' "${fs}" 2>/dev/null | grep -oP 'crtime.*--\s*\K.*') printf "%s\t%s\n" "${target}" "${crtime}" done } 

Answer 11

even better:

 lsct () { debugfs -R 'stat <'`ls -i "$1" | (read ab;echo -n $a)`'>' `df "$1" | (read a; read ab; echo "$a")` 2> /dev/null | grep --color=auto crtime | ( read abcd; echo $d ) } 

lsct / etc

Wed Jul 20 19:25:48 2016