3 ways to check file creation time in Linux

File creation time is a timestamp that is set when a file is first created. This timestamp can be used to track the age of the file.

In Linux, there are a few different ways to check the file creation time. This is useful if you need to know when a file was created for troubleshooting purposes or just to have some information about your files.

In this blog post, we will discuss three different methods that you can use to check the file creation time in Linux.

Procedure to check file creation time in Linux

1. Open the terminal and navigate to the directory where the file is located.
2. Type ls -l and press Enter. This will show you a list of all the files in the directory, as well as their permissions, size, creation date, etc.
3. Run pwd to get the file path
4. Find the device path for this file with df -h command
5. run the command debugfs -R ‘stat file path’ /dev/device to get the file creation time from the command output

check file creation time with debugfs command in Linux

The most efficient way to check the file creation time in Linux is using the debugfs command. The debugfs command is a powerful tool that can be used for debugging purposes. It can also be used to display information about a file, including the file creation time.

There are two ways to use the debugfs command. You can use the following syntax:

debugfs -R 'stat file path' /dev/device

debugfs -R 'stat <inode>' /dev/device

Let us check out the first solution.

You need the file path and device path that contains the file in debugfs command.

You might know that the df command can be used to display information about disk space usage on a Linux system. This command can also be used to find the device path for a specific file. To use this command, you will need to use the following syntax:

df [options] filename

Once you have entered this command, you should see output that looks something like this:

# df -h /etc/fstab
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1   47G  2.2G   45G   5% /

As you can see, the device path is listed under the “Filesystem” column. In this example, the file /etc/fstab is located on device /dev/vda1.

# debugfs -R 'stat /etc/fstab' /dev/vda1

debugfs 1.41.12 (17-May-2010)
Inode: 393224 Type: regular  Mode: 0644 Flags: 0x80000
Generation: 2757927007  Version: 0x00000000:00000001
User:  0 Group:  0 Size: 617
File ACL: 0  Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0  Number: 0  Size: 0
ctime: 0x584056f8:cdc15558 -- Thu Dec 1 16:59:36 2016
atime: 0x611fa87e:0fe2f650 -- Fri Aug 20 13:05:02 2021
mtime: 0x58405532:3567dff8 -- Thu Dec 1 16:52:02 2016
crtime: 0x58405532:34b0c4f8 -- Thu Dec 1 16:52:02 2016
Size of extra inode fields: 28
Extended attributes stored in inode body: 
selinux = "system_u:object_r:etc_t:s0\000" (27)
EXTENTS:
(0): 2131103

In the second method, you will need to get the inode number of the file that you want to check.

An inode is a data structure that is used to store information about a file. It contains information such as the file’s size, owner, group, permissions, and creation time. Every file on a Linux system has its own inode.

To find the inode number of a file, you can use the ls -i command. This command will list all of the files in a directory and their inode numbers. For example:

ls -i /etc/fstab

393224 /etc/fstab

As you can see, the inode number of the file is 393224. You can now use this inode number with the debugfs command to check the file creation time.

Here is the example of debugfs command.

# debugfs -R 'stat <393224>' /dev/vda1

check file creation time with stat command in Linux

Another way we will discuss is using the stat command. The stat command can be used to display a lot of information about a file, including file size, file creation time, file modification time. To use the stat command, you will need to use the following syntax:

stat [options] filename

Once you have entered this command, you should see output that looks something like this:

stat timetest
File: timetest
Size: 3      Blocks: 8     IO Block: 4096  regular file
Device: 806h/2054d Inode: 2498    Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/    mf)  Gid: ( 1000/    mf)
Access: 2022-09-05 14:00:59.327037528 +0200
Modify: 2022-09-05 14:00:54.230881818 +0200
Change: 2022-09-05 14:00:54.230881818 +0200 
Birth: 2022-09-05 14:00:13.085651618 +0200

As you can see, the file creation time is shown under the “Birth” column.

if you see the Birth field is empty in the stat command, you need to upgrade coreutils package to the latest version or you can try the the method of debugfs.

Here are the commands to check coreutils package version. You need at least version 8.32-4.1. Check this article to get more info about how to list installed packages in Linux.

• rpm -qa|grep coreutils
• yum info coreutils

check file creation time with xfs_io command in Linux

The xfs_io command is another way to check the file creation time in Linux. This command is part of the XFS filesystem and it can be used to display information about a file, including the file creation time.

To use this command, you will need to know the path of the file that you want to check. For example, if the file path is located in the /etc/fstab , you would use the following command: xfs_io

[root@hostname ~]#xfs_io 

xfs_io> open /etc/fstab

xfs_io> statx -v

fd.path = “/home/ocp/aaa”

fd.flags = non-sync,non-direct,read-write

stat.ino = 4214926

stat.type = regular file

stat.size = 5

stat.blocks = 8

stat.atime = Mon Sep 12 08:58:19 2022

stat.mtime = Mon Sep 12 08:59:33 2022

stat.ctime = Mon Sep 12 08:59:33 2022

stat.btime = Mon Sep 12 08:58:19 2022

xfs_io> q

As you can see, the xfs_io command provides a lot of information about the file. The file creation time is shown under the “stat.btime” column.

In conclusion, there are three different methods that you can use to check the file creation time in Linux. Each method has its own advantages and disadvantages, so you will need to choose the one that best suits your needs. Thanks for reading and I hope this article has been helpful.