41

Are there any (good known, reliable) file systems on Linux that store the creation time of files and directories in the i-node table?

If there are, is the "changed" time replaced by the creation time of an i-node in a stat call?

Improve this question
2

4 Answers 4

Reset to default
43

Several file systems store the file creation time, although there is no standard name for this field:

  • ufs2 → st_birthtime
  • zfs → crtime
  • ext4 → crtime
  • btrfs → otime
  • jfs → di_otime
Improve this answer
3
21

The ext4 file system does store the creation time. stat -c %W myfile can show it to you.

Improve this answer
7
  • 7
    Thanks. In my system stat -c %W returns 0 (creation time unknown), but that is another question...
    – franziskus
    Feb 17, 2011 at 6:30
  • 1
    But note that due to how files are handled by many programs, that creation time value may not be useful.
    – mattdm
    Feb 17, 2011 at 15:27
  • 16
    @Legate: if a text editor works by copying the file to a temporary location, editing the temporary working copy, and then moving the temporary copy over the original on save, when is the creation time?
    – mattdm
    Feb 20, 2011 at 14:02
  • 1
    Does this need to be enabled somehow? I tried to get the crtime for a file on an ext4 filesystem and got zero. Having previously read this blog post, I also tried using debugfs and stat which revealed that there is no crtime. So I wonder if it needs to be enabled somehow? (FWIW I use Arch Linux)
    – starfry
    Apr 17, 2018 at 8:20
  • 3
    There does seem to be a way to get the file creation time in Linux. See: unix.stackexchange.com/a/131347/182996
    – kaartic
    Oct 24, 2018 at 8:02
4

As far as I know ext4, JFS and BTRFS file systems all support an extra field in the files inode to store the creation time, though the naming might differ.

Source: LWN File Creation Times

Improve this answer
4
  • // , Have you been able to verify this? AFAIK is sort of weak, for my taste, at least.
    – Nathan Basanese
    Aug 21, 2015 at 19:24
  • 5
    @NathanBasanese The AFAIK was reporting to JFS and BTRFS. For ext4, yes it supports it. Check debugfs command stat. Exemple: you need to thing the device where you ext4 filesystem is mounted (e.g. /dev/sda3) and you need to get a file inode number within that file system (use ls -i, let say 42000 is the number), then you simply type: debugfs -R 'stat <42000>' /dev/sda3. Run this as root, or with enough privilege. Look for the crtime field, that's the one. For JFS and BTRFS, you would need to find the equivalent debugfs command...
    – Huygens
    Aug 21, 2015 at 22:15
  • // , NIIICE. I tried $ ls -i | grep dump.rdb 656376 dump.rdb and $ sudo debugfs -R 'stat <656376>' /dev/sda2, but I think I don't have ext4 on there, yet. If I try it on an ext4, I'll say so.
    – Nathan Basanese
    Aug 21, 2015 at 23:10
  • @NathanBasanese You can do df -T to get the partition type or simply type mount. Make sure that the file inode belong to the correct partition. Inodes are (per their nature) specific to a partition.
    – Huygens
    Aug 22, 2015 at 20:27
3

xfs v5 supports crtime

# dmesg | grep -iE 'xfs.*\s+mounting' | head -1
[   10.939721] XFS (dm-1): Mounting V5 Filesystem

shows using V5. Then get file inode number ;

# stat -c '%i' test.txt
68227195

Then get crtime ;

# xfs_db -r -c "inode 68227195" -c "p v3.crtime.sec" <device eg. /dev/mapper/rl-root>
v3.crtime.sec = Mon Jun  6 15:13:02 2022

or on one line:

xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" <device>

EDIT

...an easier way;

use stat <filename> for the same result returned as "Birth"

[root@wsa test]# pwd
/root/test

[root@wsa test]# ls
total 8.0K
67109562    0 drwxr-xr-x.  2 root root   22 Mar 22 00:07 .
     133 4.0K dr-xr-x---. 19 root root 4.0K Mar 21 23:54 ..
67552174 4.0K -rw-r--r--.  1 root root   10 Mar 22 00:07 test.txt

[root@wsa test]# df .
Filesystem          1K-blocks     Used Available Use% Mounted on
/dev/mapper/al-root 104806400 25289868  79516532  25% /

[root@wsa test]# xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" /dev/mapper/al-root
v3.crtime.sec = Tue Mar 21 23:55:55 2023

[root@wsa test]# stat test.txt
  File: test.txt
  Size: 10              Blocks: 8          IO Block: 4096   regular file
Device: fd01h/64769d    Inode: 67552174    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2023-03-22 00:07:38.926108379 +0000
Modify: 2023-03-22 00:07:55.794041676 +0000
Change: 2023-03-22 00:07:55.794041676 +0000
 Birth: 2023-03-21 23:55:55.413859045 +0000

performed with;

Operating System: AlmaLinux 8.7 (RHEL clone)
Kernel Version: 4.18.0-425.13.1.el8_7.x86_64 (64-bit)
    
[root@wsa test]# stat --version
stat (GNU coreutils) 8.30
Copyright (C) 2018 Free Software Foundation, Inc.
    
[root@wsa test]# xfs_db -r /dev/mapper/al-root
xfs_db> version
versionnum [0xb4b5+0x18a] = V5,NLINK,DIRV2,ATTR,ALIGN,LOGV2,EXTFLG,MOREBITS,ATTR2,LAZYSBCOUNT,PROJID32BIT,CRC,FTYPE,FINOBT,SPARSE_INODES,REFLINK
Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.