140

In what order are the dated ordered by? Certainly not alphanumeric order.

ls -lt sorts by modification time. But I need creation time.

111

Most unices do not have a concept of file creation time. You can't make ls print it because the information is not recorded. If you need creation time, use a version control system: define creation time as the check-in time.

If your unix variant has a creation time, look at its documentation. For example, on Mac OS X (the only example I know of¹), use ls -tU. Windows also stores a creation time, but it's not always exposed to ports of unix utilities, for example Cygwin ls doesn't have an option to show it. The stat utility can show the creation time, called “birth time” in GNU utilities, so under Cygwin you can show files sorted by birth time with stat -c '%W %n' * | sort -k1n.

Note that the ctime (ls -lc) is not the file creation time, it's the inode change time. The inode change time is updated whenever anything about the file changes (contents or metadata) except that the ctime isn't updated when the file is merely read (even if the atime is updated). In particular, the ctime is always more recent than the mtime (file content modification time) unless the mtime has been explicitly set to a date in the future.

| improve this answer | |
  • 1
    In Cygwin it is ls -c. ls --help shows what -c does when combined with -l and -lt. – Aaron D. Marasco Sep 12 '11 at 1:37
  • 7
    @Aaron No, the ctime is not the creation time. It's a common confusion based purely on the fact that “ctime” and “creation” start with the same letter, but there is no relation between ctime and creation time. I've updated my answer to address this confusion. – Gilles 'SO- stop being evil' Sep 12 '11 at 11:31
  • LOL my bad. I was trying to confirm the Cygwin part for ya (IIRC your original post had a possible command). It does specifically say "ctime (time of last modification of file status information)" if I had paid attention. – Aaron D. Marasco Sep 13 '11 at 2:02
  • Adding to @Gilles answer; I use an NFS 3.x file server (unsure on the underlying file system; it's either UFS or ZFS, though I'm guessing UFS). Under Redhat 6.x: -U sorts by creation time. Under Solaris 10.x: /usr/bin/ls does not support -U, /usr/ucb/ls supports -U and does sort by creation time. These results obviously depend on the filesystem storing that info in the first place. – Brian Vandenberg Jun 12 '12 at 19:44
  • 1
    @ghoti If no files were ever deleted (or moved/renamed/hardlinked/…) in the directory, then the directory order is creation order on some filesystems, but not all. That's not true on ext4, for example. I don't know if it's true on Solaris's UFS. – Gilles 'SO- stop being evil' Feb 12 '16 at 12:34
19

Unfortunately, the stat(2) API does not provide a way to get the file creation time, as it is not required by the Unix standards.

However, some filesystems, as ext4, do save this information within the file metadatas. There is just no standard way to get it, but there is a way (ext filesystems only):

debugfs -R 'stat partition/relative/path/to/file' /dev/sda1

You would get something like that mentioning crtime (not ctime!) if you use ext4.

 ctime: 0x513a50e5:d4e448f0 -- Fri Mar  8 21:58:13 2013
 atime: 0x513dd8f1:04df0b20 -- Mon Mar 11 14:15:29 2013
 mtime: 0x513a50e5:d4e448f0 -- Fri Mar  8 21:58:13 2013
crtime: 0x513a259a:35191a3c -- Fri Mar  8 18:53:30 2013

This command may take some time to return, probably because it also lists every extent related to the file.

Now if you want to order files by creation date, I guess this is not easily (nor properly) possible. As Gilles says, it would probably be easier if you'd use a revision control system. But you may try to have a look at the ext4 API...

I tried the stat -c '%w' myfile command on a ext4 filesytem on a (recent enough) Ubuntu system without success (it just answers -).


UPDATE : since Linux kernel 4.11, a new statx(2) system call has been introduced. Its API can give access to file creation time, if the info is available on the filesystem. To my knowledge, there is no standard/stable userspace utility allowing us to get this info yet, but it will probably appear in some time. This is not a standard POSIX interface though, but a Linux specific, says the man:

statx() was added to Linux in kernel 4.11; library support was added in glibc 2.28.

statx() is Linux-specific.

| improve this answer | |
  • If anyone want a one liner : f='/path/to/file'; debugfs -R "stat $f" $(df $f|(read a; read a b; echo "$a"))|grep crtime – Boop Mar 27 '18 at 11:37
4

Here's a Perl script which uses Totor's answer to achieve what you want (if your filesystem is ext4).

Works on my home machine (Ubuntu) and my server (CentOS), but not tested beyond that, so ymmv.

#!/usr/bin/env perl

use Modern::Perl '2009';

use DateTime;


# Open the current directory for reading
opendir my $dh, "." or die "Unable to open directory: $!";

# Create a hash to save results into
my %results;
my %datestamp;

# Loop through the directory getting creation date stats for each file
while ( my $filename = readdir $dh ) {
    # Skip non-files
    next if $filename eq '.' or $filename eq '..';

    # Save the ls output for this file/directory
    $results{ $filename } = `ls -ld $filename`;

    my $stats = `debugfs -R 'stat $filename' /dev/sda6 2>/dev/null`;
    # crtime: 0x51cd731c:926999ec -- Fri Jun 28 12:27:24 2013
    $stats =~ m/crtime\: \w+\:\w+ -- (.+?)\n/s;
    my $datestring = $1;

    # Dissect date with a regexp, ick
    my %months = (
        'Jan' => '1',
        'Feb' => '2',
        'Mar' => '3',
        'Apr' => '4',
        'May' => '5',
        'Jun' => '6',
        'Jul' => '7',
        'Aug' => '8',
        'Sep' => '9',
        'Oct' => '10',
        'Nov' => '11',
        'Dec' => '12',
    );
    $datestring =~ m/\w+ (\w+)  ?(\d+) (\d\d)\:(\d\d)\:(\d\d) (\d\d\d\d)/;

    # Convert date into a more useful format
    my $dt = DateTime->new(
        year   => $6,
        month  => $months{$1},
        day    => $2,
        hour   => $3,
        minute => $4,
        second => $5,
    );

    # Save the datestamp for this result
    $datestamp{ $filename } = $dt->iso8601;
}

# Output in date order
my @filenames = sort { $datestamp{$a} gt $datestamp{$b} } keys %datestamp;

foreach my $filename ( @filenames ) {
    print $results{ $filename };
}
| improve this answer | |
  • Also good to mention that some files may have metadata (such as exif) which record the creation date/time. If all of your files happen to be digital photos for example, you most likely have this data. Here is an example using perl's Image::ExifTool. – Jonathan Cross Jan 24 '17 at 20:48
  • Lots of warnings/errors in this.. Use of uninitialized value $datestring in pattern match (m//) at sort-by-create-time.pl line 43. Use of uninitialized value $1 in hash element at sort-by-create-time.pl line 48. Use of uninitialized value in subroutine entry at /usr/lib/x86_64-linux-gnu/perl5/5.22/DateTime.pm line 197. Use of uninitialized value within @DB::args in list assignment at /usr/share/perl/5.22/Carp.pm line 228. The 'minute' parameter (undef) to DateTime::new was an 'undef'... – user239558 Mar 6 at 21:01
4

Use this command ls -lct to sort files as per creation date.

| improve this answer | |
  • 2
    yup that is not the "correct" command, but it is what you are looking for in most cases – madnight Feb 16 '18 at 20:25
  • is there a way to do this with "find" so that it prints all files in subdirectories this way? – Colin D May 1 '19 at 19:40
  • 1
    The ctime is change time, and not create time. – Nabi K.A.Z. Sep 23 '19 at 10:38
  • fair enough worked for me. – Smeterlink May 7 at 17:39
3

On Linux systems running kernel 4.11 or later, with glibc 2.28 or later, and coreutils 8.31 or later, stat can show a file’s birth time on file systems which store it. Output similar to that of ls -l can be obtained with

stat -c "%A %4h %U %G %10s %.16w %n" *

and sorted output with

stat -c "%W %A %4h %U %G %10s %.16w %n" * | sort -k1,1n | cut -d\  -f2-

This uses these formatting options:

  • %W: the birth time, in seconds since the Unix epoch
  • %A: the file type and permissions, in ls -l format
  • %4h: the number of hard links to the file, aligned to four characters
  • %U: the owning user’s name
  • %G: the owning group’s name
  • %10s: the file size, aligned to ten characters
  • %.16w: the birth time, in human-readable format, truncated to sixteen characters (enough to show the year, month, day, hour, minute and second)
  • %n: the file’s name
| improve this answer | |
  • This is decently fast on a large directory! – user239558 Mar 6 at 21:03
1

To do it in shell. ls do not provide creation time but change time. Only debugfs can show creation time if partition is ext4

disk=$(df -Th . | grep ext4  |awk '{print $1}')
for file in "."/*
do
    inode=$(ls -i $file | awk '{print $1}')
    crtime=$(debugfs -R "stat <$inode>" $disk 2>/dev/null | grep crtime |  awk -F'-- ' '{print $2}' | awk '{print $2,$3,$5,$4}')

    printf "$crtime\t$file\n"
done | sort -k4 | sort -n -k 3 -k 1M -k2 -k4
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.