I have a linux server which captures network pcap files and save it to a CIFS shared drive. I have found out that the creation time and modified time of the pcap files seems to be the same. Which shouldn't be, as each file has 10 seconds of data so the creation time should be 10 seconds older than the modified time. If I'm correctly understanding the time attributes. I need this difference as the software with which I extract the files from the shared drive fixes the time span with start time as creation time of first file and end time as "last write /modified time" of the last file. Is this happening because of a linux bug? I know there will be a difference in the creation time and modified time as I have seen it before on the system few months ago.
Linux doesn't have an easily accessible file creation timestamp (but see Stéphane's comment below). Running
stat on a file I've just created shows a Access, Modify and Change timestamp - but no creation.
I'm guessing that maybe the CIFS share you viewed a few months ago was not created by a Linux system? Maybe it was a Windows system shared by CIFS?
Linux does have creation time but it's not easily accessible. Jul 3, 2014 at 14:32
For the record it's possible to get the file creation timestamp of a file (along with the rest) on a SAMBA/SMB/CIFS share with
smbinfo filebasicinfo /mnt/share/folder/file Creation Time Fri Jun 25 13:40:25 2021 Last Access Time Fri Jan 6 07:34:38 2023 Last Write Time Fri Jan 6 07:35:18 2023 Last Change Time Fri Jan 6 12:29:21 2023 File Attributes 0x00000010: