41

Are there any (good known, reliable) file systems on Linux that store the creation time of files and directories in the i-node table?

If there are, is the "changed" time replaced by the creation time of an i-node in a stat call?

2

4 Answers 4

Reset to default
43

Several file systems store the file creation time, although there is no standard name for this field:

  • ufs2 → st_birthtime
  • zfs → crtime
  • ext4 → crtime
  • btrfs → otime
  • jfs → di_otime
3
21

The ext4 file system does store the creation time. stat -c %W myfile can show it to you.

8
  • 8
    Thanks. In my system stat -c %W returns 0 (creation time unknown), but that is another question...
    – franziskus
    Feb 17, 2011 at 6:30
  • 16
    @Legate: if a text editor works by copying the file to a temporary location, editing the temporary working copy, and then moving the temporary copy over the original on save, when is the creation time?
    – mattdm
    Feb 20, 2011 at 14:02
  • 2
    Does this need to be enabled somehow? I tried to get the crtime for a file on an ext4 filesystem and got zero. Having previously read this blog post, I also tried using debugfs and stat which revealed that there is no crtime. So I wonder if it needs to be enabled somehow? (FWIW I use Arch Linux)
    – starfry
    Apr 17, 2018 at 8:20
  • 2
    @starfry there is currently no way for userspace to obtain the creation time of a file under Linux. stat -c %W presumably works on (some) BSDs, but it can’t output non-0 on Linux.
    – Stephen Kitt
    Aug 28, 2018 at 15:57
  • 3
    There does seem to be a way to get the file creation time in Linux. See: unix.stackexchange.com/a/131347/182996
    – kaartic
    Oct 24, 2018 at 8:02
4

As far as I know ext4, JFS and BTRFS file systems all support an extra field in the files inode to store the creation time, though the naming might differ.

Source: LWN File Creation Times

4
  • 1
    // , Have you been able to verify this? AFAIK is sort of weak, for my taste, at least.
    – Nathan Basanese
    Aug 21, 2015 at 19:24
  • 5
    @NathanBasanese The AFAIK was reporting to JFS and BTRFS. For ext4, yes it supports it. Check debugfs command stat. Exemple: you need to thing the device where you ext4 filesystem is mounted (e.g. /dev/sda3) and you need to get a file inode number within that file system (use ls -i, let say 42000 is the number), then you simply type: debugfs -R 'stat <42000>' /dev/sda3. Run this as root, or with enough privilege. Look for the crtime field, that's the one. For JFS and BTRFS, you would need to find the equivalent debugfs command...
    – Huygens
    Aug 21, 2015 at 22:15
  • // , NIIICE. I tried $ ls -i | grep dump.rdb 656376 dump.rdb and $ sudo debugfs -R 'stat <656376>' /dev/sda2, but I think I don't have ext4 on there, yet. If I try it on an ext4, I'll say so.
    – Nathan Basanese
    Aug 21, 2015 at 23:10
  • @NathanBasanese You can do df -T to get the partition type or simply type mount. Make sure that the file inode belong to the correct partition. Inodes are (per their nature) specific to a partition.
    – Huygens
    Aug 22, 2015 at 20:27
3

xfs v5 supports crtime

# dmesg | grep -iE 'xfs.*\s+mounting' | head -1
[   10.939721] XFS (dm-1): Mounting V5 Filesystem

shows using V5. Then get file inode number ;

# stat -c '%i' test.txt
68227195

Then get crtime ;

# xfs_db -r -c "inode 68227195" -c "p v3.crtime.sec" <device eg. /dev/mapper/rl-root>
v3.crtime.sec = Mon Jun  6 15:13:02 2022

or on one line:

xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" <device>

EDIT

...an easier way;

use stat <filename> for the same result returned as "Birth"

[root@wsa test]# pwd
/root/test

[root@wsa test]# ls
total 8.0K
67109562    0 drwxr-xr-x.  2 root root   22 Mar 22 00:07 .
     133 4.0K dr-xr-x---. 19 root root 4.0K Mar 21 23:54 ..
67552174 4.0K -rw-r--r--.  1 root root   10 Mar 22 00:07 test.txt

[root@wsa test]# df .
Filesystem          1K-blocks     Used Available Use% Mounted on
/dev/mapper/al-root 104806400 25289868  79516532  25% /

[root@wsa test]# xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" /dev/mapper/al-root
v3.crtime.sec = Tue Mar 21 23:55:55 2023

[root@wsa test]# stat test.txt
  File: test.txt
  Size: 10              Blocks: 8          IO Block: 4096   regular file
Device: fd01h/64769d    Inode: 67552174    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2023-03-22 00:07:38.926108379 +0000
Modify: 2023-03-22 00:07:55.794041676 +0000
Change: 2023-03-22 00:07:55.794041676 +0000
 Birth: 2023-03-21 23:55:55.413859045 +0000

performed with;

Operating System: AlmaLinux 8.7 (RHEL clone)
Kernel Version: 4.18.0-425.13.1.el8_7.x86_64 (64-bit)
    
[root@wsa test]# stat --version
stat (GNU coreutils) 8.30
Copyright (C) 2018 Free Software Foundation, Inc.
    
[root@wsa test]# xfs_db -r /dev/mapper/al-root
xfs_db> version
versionnum [0xb4b5+0x18a] = V5,NLINK,DIRV2,ATTR,ALIGN,LOGV2,EXTFLG,MOREBITS,ATTR2,LAZYSBCOUNT,PROJID32BIT,CRC,FTYPE,FINOBT,SPARSE_INODES,REFLINK
2
  • thanks for sharing this - it was not an immediate search result 👍 it might be worth x-posting on stackoverflow.com/q/31233316/490487 ?
    – Kyle
    Jan 26 at 12:56
  • stat 8.22 does not read crtime on RH7: stat gives Birth : - but xfs_db gives v3.crtime.sec = Tue Apr 11 12:58:52 2023
    – Mat M
    Jul 21 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .