32

Are there any (good known, reliable) file systems on Linux that store the creation time of files and directories in the i-node table?

If there are, is the "changed" time replaced by the creation time of an i-node in a stat call?

16

The ext4 file system does store the creation time. stat -c %W myfile can show it to you.

  • 6
    Thanks. In my system stat -c %W returns 0 (creation time unknown), but that is another question... – franziskus Feb 17 '11 at 6:30
  • 1
    But note that due to how files are handled by many programs, that creation time value may not be useful. – mattdm Feb 17 '11 at 15:27
  • 15
    @Legate: if a text editor works by copying the file to a temporary location, editing the temporary working copy, and then moving the temporary copy over the original on save, when is the creation time? – mattdm Feb 20 '11 at 14:02
  • 1
    Does this need to be enabled somehow? I tried to get the crtime for a file on an ext4 filesystem and got zero. Having previously read this blog post, I also tried using debugfs and stat which revealed that there is no crtime. So I wonder if it needs to be enabled somehow? (FWIW I use Arch Linux) – starfry Apr 17 '18 at 8:20
  • 2
    There does seem to be a way to get the file creation time in Linux. See: unix.stackexchange.com/a/131347/182996 – kaartic Oct 24 '18 at 8:02
30

Several file systems store the file creation time, although there is no standard name for this field:

  • ufs2 → st_birthtime
  • zfs → crtime
  • ext4 → crtime
  • btrfs → otime
  • jfs → di_otime
4

As far as I know ext4, JFS and BTRFS file systems all support an extra field in the files inode to store the creation time, though the naming might differ.

Source: LWN File Creation Times

  • // , Have you been able to verify this? AFAIK is sort of weak, for my taste, at least. – Nathan Basanese Aug 21 '15 at 19:24
  • 5
    @NathanBasanese The AFAIK was reporting to JFS and BTRFS. For ext4, yes it supports it. Check debugfs command stat. Exemple: you need to thing the device where you ext4 filesystem is mounted (e.g. /dev/sda3) and you need to get a file inode number within that file system (use ls -i, let say 42000 is the number), then you simply type: debugfs -R 'stat <42000>' /dev/sda3. Run this as root, or with enough privilege. Look for the crtime field, that's the one. For JFS and BTRFS, you would need to find the equivalent debugfs command... – Huygens Aug 21 '15 at 22:15
  • // , NIIICE. I tried $ ls -i | grep dump.rdb 656376 dump.rdb and $ sudo debugfs -R 'stat <656376>' /dev/sda2, but I think I don't have ext4 on there, yet. If I try it on an ext4, I'll say so. – Nathan Basanese Aug 21 '15 at 23:10
  • @NathanBasanese You can do df -T to get the partition type or simply type mount. Make sure that the file inode belong to the correct partition. Inodes are (per their nature) specific to a partition. – Huygens Aug 22 '15 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.