Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This question already has an answer here:

How can i see when a file was created. I have looked at man page

ls -lc is for last modification of file status

ls -lu for access time

ls -l not exactly indicated which time, last changed?

I tried these, but they don't give me time the file was created.

share|improve this question

marked as duplicate by Mikel, Anthon, slm, Zelda, goldilocks Mar 14 at 17:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
*nix systems don't keep track of file creation time. –  devnull Mar 14 at 13:56
    
stackoverflow.com/questions/14842195/… explains your problem –  David Wilkins Mar 14 at 13:59
    
What are the legitimate uses of the touch command? The lack of create time is covered in that Q&A. –  slm Mar 14 at 14:02
    
Also this Q&A: get age of given file –  slm Mar 14 at 14:05
    
In OS X you can use ls -lU, stat -f%B, GetFileInfo -d, or mdls -n kMDItemFSCreationDate. –  Lri Apr 25 at 0:57

1 Answer 1

On OS/X or FreeBSD, it's the -U option. Linux now also stores the birth/creation time on most of its native file systems, but there's no API to retrieve it yet.

On ext4 filesystems, you can use debugfs to get it though:

$ sudo debugfs /dev/some/fs
stat /some/file
[...]
crtime: 0x53208d7a:9045625c -- Wed Mar 12 16:38:18 2014
[...]

(where /some/file is the path within that filesystem)

For NTFS filesystems, and assuming you're using ntfs-3g to mount it, see How do I get the creation date of a file on an NTFS logical volume?

Traditionally, Unix didn't store a creation time.

Note that that value maybe has less meaning that you might think. The modification time reflects the age of the data in that file, the access time when it was last accessed, the inode change-time is very useful to backup software for instance, because you know nothing about that file has changed since that time (except possibly its full path for which you can have a look at the ctime of its directory components).

The creation time is when the inode spawn into existence (well had a link count going from 0 to 1, that inode might have been allocated and removed in a previous life), it doesn't reflect the age of any data associated with that file (data is written after the file has been created), it doesn't tell us whether a file by that path went into existence at that time (the file we're looking at can have been created with a different path and linked or moved there later).

share|improve this answer
1  
Note with debugfs the paths used here must be either relative or absolute (leading / is not needed) to the root of the filesystem and not the system root. –  Graeme Mar 14 at 14:05
    
@Graeme, debugfs has a cd command, so relative paths are relative to that debugfs working directory managed by that cd command, but yes the absolute paths are paths in that file system, so relative to the root of the filesystem, I've updated the answer. –  Stéphane Chazelas Mar 14 at 14:21
    
From your last part, an example of where the creation time is effectively invalidated is when programs update files by writing the data to a different file and atomically moving the location of the new file to the original. The inode and creation time for the new file is used rather than the original, as might be expected. Two programs that do this by default are rsync and vim. –  Graeme Mar 14 at 15:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.