3 ways to check file creation time in Linux

File creation time is a timestamp that is set when a file is first created. This timestamp can be used to track the age of the file.

In Linux, there are a few different ways to check the file creation time. This is useful if you need to know when a file was created for troubleshooting purposes or just to have some information about your files.

In this blog post, we will discuss three different methods that you can use to check the file creation time in Linux.

Table of Contents

Procedure to check file creation time in Linux

Open the terminal and navigate to the directory where the file is located.
Type ls -l and press Enter. This will show you a list of all the files in the directory, as well as their permissions, size, creation date, etc.
Run pwd to get the file path
Find the device path for this file with df -h command
run the command debugfs -R ‘stat file path’ /dev/device to get the file creation time from the command output

check file creation time with debugfs command in Linux

The most efficient way to check the file creation time in Linux is using the debugfs command. The debugfs command is a powerful tool that can be used for debugging purposes. It can also be used to display information about a file, including the file creation time.

There are two ways to use the debugfs command. You can use the following syntax:

debugfs -R 'stat file path' /dev/device

debugfs -R 'stat <inode>' /dev/device

Let us check out the first solution.

You need the file path and device path that contains the file in debugfs command.

You might know that the df command can be used to display information about disk space usage on a Linux system. This command can also be used to find the device path for a specific file. To use this command, you will need to use the following syntax:

df [options] filename

Once you have entered this command, you should see output that looks something like this:

# df -h /etc/fstab
Filesystem Size Used Avail Use% Mounted on
/dev/vda1 47G 2.2G 45G 5% /

As you can see, the device path is listed under the “Filesystem” column. In this example, the file /etc/fstab is located on device /dev/vda1.

# debugfs -R 'stat /etc/fstab' /dev/vda1

debugfs 1.41.12 (17-May-2010) Inode: 393224 Type: regular Mode: 0644 Flags: 0x80000 Generation: 2757927007 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 617 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x584056f8:cdc15558 -- Thu Dec 1 16:59:36 2016 atime: 0x611fa87e:0fe2f650 -- Fri Aug 20 13:05:02 2021 mtime: 0x58405532:3567dff8 -- Thu Dec 1 16:52:02 2016 crtime: 0x58405532:34b0c4f8 -- Thu Dec 1 16:52:02 2016 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "system_u:object_r:etc_t:s0\000" (27) EXTENTS: (0): 2131103

In the second method, you will need to get the inode number of the file that you want to check.

An inode is a data structure that is used to store information about a file. It contains information such as the file’s size, owner, group, permissions, and creation time. Every file on a Linux system has its own inode.

To find the inode number of a file, you can use the ls -i command. This command will list all of the files in a directory and their inode numbers. For example:

ls -i /etc/fstab

393224 /etc/fstab

As you can see, the inode number of the file is 393224. You can now use this inode number with the debugfs command to check the file creation time.

Here is the example of debugfs command.

# debugfs -R 'stat <393224>' /dev/vda1

check file creation time with stat command in Linux

Another way we will discuss is using the stat command. The stat command can be used to display a lot of information about a file, including file size, file creation time, file modification time. To use the stat command, you will need to use the following syntax:

stat [options] filename

Once you have entered this command, you should see output that looks something like this:

stat timetest File: timetest Size: 3 Blocks: 8 IO Block: 4096 regular file Device: 806h/2054d Inode: 2498 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/ mf) Gid: ( 1000/ mf) Access: 2022-09-05 14:00:59.327037528 +0200 Modify: 2022-09-05 14:00:54.230881818 +0200 Change: 2022-09-05 14:00:54.230881818 +0200 Birth: 2022-09-05 14:00:13.085651618 +0200

As you can see, the file creation time is shown under the “Birth” column.

if you see the Birth field is empty in the stat command, you need to upgrade coreutils package to the latest version or you can try the the method of debugfs.

Here are the commands to check coreutils package version. You need at least version 8.32-4.1. Check this article to get more info about how to list installed packages in Linux.

rpm -qa|grep coreutils
yum info coreutils

check file creation time with xfs_io command in Linux

The xfs_io command is another way to check the file creation time in Linux. This command is part of the XFS filesystem and it can be used to display information about a file, including the file creation time.

To use this command, you will need to know the path of the file that you want to check. For example, if the file path is located in the /etc/fstab , you would use the following command: xfs_io

[root@hostname ~]#xfs_io

xfs_io> open /etc/fstab

xfs_io> statx -v

fd.path = “/home/ocp/aaa”

fd.flags = non-sync,non-direct,read-write

stat.ino = 4214926

stat.type = regular file

stat.size = 5

stat.blocks = 8

stat.atime = Mon Sep 12 08:58:19 2022

stat.mtime = Mon Sep 12 08:59:33 2022

stat.ctime = Mon Sep 12 08:59:33 2022

stat.btime = Mon Sep 12 08:58:19 2022

xfs_io> q

As you can see, the xfs_io command provides a lot of information about the file. The file creation time is shown under the “stat.btime” column.

In conclusion, there are three different methods that you can use to check the file creation time in Linux. Each method has its own advantages and disadvantages, so you will need to choose the one that best suits your needs. Thanks for reading and I hope this article has been helpful.