4

I am trying to track the completion of a silent installer by detecting the presence of the last file created by it, but in order to do that I need to find out which file that is. Is there any way to do this? I have found a lot of answers on how to find the most recently modified file, but that is not effective since many of these files were modified by the original creator in a different order than they are added to the system by the installer.

5
  • Which filesystem? Which OS?
    – muru
    Nov 17, 2015 at 16:00
  • reading around it seems that only FreeBSD and the UFS2 filesystem support file creation times.
    – lese
    Nov 17, 2015 at 16:02
  • Supporting file creation times as an attribute of the inode is fairly unreliable anyway, since quite a few programs will "modify" a file by writing it out completely to a new file (hence a new inode) and renaming it over the old one.
    – Tom Hunt
    Nov 17, 2015 at 16:16
  • To address the question, you might be able to find the files with the most recent change time. Unlike modification time, change time can't be altered from user space, so a file that was just created will indeed have a just-now ctime.
    – Tom Hunt
    Nov 17, 2015 at 16:17
  • This won't be reliable anyway: how would you distinguish files changed by the installer from files changed by some other program? How would you tell that the installer has finished and is not preparing to write some other file? Why are you trying such a complex indirect method instead of waiting for the installer process to finish?
    – Gilles 'SO- stop being evil'
    Nov 17, 2015 at 23:34

1 Answer 1

Reset to default
3

Agreeing that change-time (aka ctime) is the most portable feature that can be observed on a *nix filesystem, OP may need more detail.

POSIX <sys/stat.h> documents three timestamps for every file, directory, device on a filesystem: access, modification and changed. The first two can be set to arbitrary values using utimes (widely available though tagged as an extension), but the last cannot. It is updated to the current time as a side-effect of many system calls, including utimes. Likely it most often is updated by chmod, but also moving or renaming a file does this as well.

However, if you happen to be looking for clues about when a file was created, the ctime is as good a clue as you are likely to find. Access time can also be useful, but some filesystems can be configured to avoid updating that. Look first at ctime.

The find program (also documented in POSIX) includes an option to use ctime:

-ctime n
The primary shall evaluate as true if the time of last change of file status information subtracted from the initialization time, divided by 86400 (with any remainder discarded), is n.

The 86400 refers to the number of seconds in a day; n is an integer (the number of days). Some implementations of find provide for smaller units, but those are not in POSIX.

You could use it like this to get a list of files changed within the past day:

find . -ctime -1 -print

Some implementations may allow a non-integer value for n, but POSIX is explicit here:

In the descriptions, wherever n is used as a primary argument, it shall be interpreted as a decimal integer optionally preceded by a plus ( '+' ) or minus-sign ( '-' )

so it is not possible to have a POSIX-compliant extension in that direction. Other implementations may provide alternate options which (for example) specify the time difference as a number of minutes. You should consult the manual for find for the system you are using, to see if this applies to you.

One of the comments mentioned some filesystems with an extension (aka non-standard) to get the actual file creation time. Various systems have had this over the years including

  • VMS (later renamed to OpenVMS), with creation, backup, revision and expiration timestamps.
  • Windows, with creation, access and modification timestamps (noting that while the names are similar, the rules for updating differ from POSIX).

There is more pertinent discussion in How to get file creation date in Linux?, which mentions a st_birthtime member for the stat structure. That is documented in manual pages for both OSX stat(2) and FreeBSD stat(2), as well as in the system-specific FreeBSD stat(1) and OSX stat(1) utilities. (NetBSD also documents this extension). Call it a feature of modern BSD systems, for short.

The corresponding find utility supports the extension as well (see for example OSX find(1)):

all of the -B* birthtime related primaries are extensions to IEEE Std 1003.1-2001 (``POSIX.1'').

Other systems do not have this extension. For discussion:

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .