Facebook Twitter Instagram
    TecAdmin
    • Home
    • Ubuntu 20.04
      • Upgrade Ubuntu
      • Install Java
      • Install Node.js
      • Install Docker
      • Install LAMP Stack
    • Tutorials
      • AWS
      • Shell Scripting
      • Docker
      • Git
      • MongoDB
    • FeedBack
    • Submit Article
    • About Us
    Facebook Twitter Instagram
    TecAdmin
    Home»Linux Commands»How to Find File Creation Time (crtime) in Linux

    How to Find File Creation Time (crtime) in Linux

    RahulBy RahulSeptember 13, 20132 Mins ReadUpdated:June 14, 2017

    File creation time is stored in inode in EXT4 file system. An earlier version of EXT files systems doesn’t support file creation time.

    There is a crtime (create time) timestamp in the debugfs stat output. finally EXT4 supports create time just like btime in NTFS windows.

    Follow below instructions to how to find file creation time. Select an existing file or create a new file for testing. For this example, I am using an existing file.

    Step 1 – Find Inode Number of File

    First of all, find the inode number of any file using the following command on terminal.

    $ ls -i /var/log/secure
    
    13377 /var/log/syslog
    

    Step 2 – Find File Creation Time (crtime)

    After getting the inode number of file, Use debugfs command with inode number stats following by disk path.

    $ debugfs -R 'stat <inode_number>' /dev/sda1
    
    Implementation:
    $ debugfs -R 'stat <13377>' /dev/sda1
    
    debugfs 1.41.12 (17-May-2010)
    Inode: 13377   Type: regular    Mode:  0600   Flags: 0x80000
    Generation: 2326794244    Version: 0x00000000:00000001
    User:     0   Group:     0   Size: 223317
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 440
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
     atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
     mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
    crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011
    Size of extra inode fields: 28
    Extended attributes stored in inode body:
      selinux = "system_u:object_r:var_log_t:s000" (31)
    EXTENTS:
    (0-24): 35008-35032, (25-54): 164224-164253
    

    Find the entry of crtime in above output. This is the actual file creation time.

    References:
    Read more about ext4 file system: https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout

    crtime crtime in ext4 debugfs file creation time
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email WhatsApp
    Previous ArticleHow to Reset ( Re-Sync ) MySQL Master-Slave Replication
    Next Article Top 5 VPS Hosting Providers

    Related Posts

    How to Search Recently Modified Files in Linux

    2 Mins Read

    Bash Printf Command

    Updated:December 23, 20212 Mins Read

    Tee Command in Linux with Examples

    4 Mins Read

    How to Scan Open Ports with Nmap

    5 Mins Read

    Handling filenames with spaces in Linux

    3 Mins Read

    How To Compare Two Files in Linux

    Updated:August 23, 20215 Mins Read

    9 Comments

    1. Christopher on December 2, 2019 6:40 am

      How to find all files creation date and time in unix ??

      Reply
    2. shell on September 30, 2019 12:28 pm

      Hi ,

      I wanted to to copies files from one location to another which is created on time 00:05 .

      File names := a****.txt (after a ther is incremental number but i need to choose file with time)
      Could you please suggest as soon as …..

      Reply
    3. Akash on March 26, 2019 9:07 am

      sudo debugfs -R ‘stat ‘ /dev/sddb1

      I am using google cloude shell and above command returns same results as “debugfs 1.43.4 (31-Jan-2017)” for all file inode number

      Reply
      • Wakar Khan on November 1, 2021 7:10 am

        I am also retrieving the creation date of file but your suggested is not working for me and getting “Bad magic number in super-block while opening the file system” . Please suggest appropriate solution for this.

        Reply
    4. aaf2 on December 16, 2018 2:35 pm

      sick! why so complicated? why linux prorammers not added it as standard??

      Reply
    5. Benjamin Abbott-Scott on March 29, 2018 6:59 pm

      You can also simply specify filename (at least on CentOS and AmazonOS) instead of inode:

      $ sudo debugfs -R ‘stat /bin/ls’ /dev/xvda1
      …
      crtime: 0x57699f20:712d39fc — Tue Jun 21 13:10:08 2016
      …

      Reply
      • Wakar Khan on November 1, 2021 7:12 am

        I am also retrieving the creation date of file but your suggested command is not working for me and getting “Bad magic number in super-block while opening the file system” . Please suggest appropriate solution for this.

        Reply
    6. Anoop on January 10, 2018 7:04 am

      Rahul,

      That was extremely helpful and very clear.
      Thanks a tonne!

      Anoop
      A fellow Linux enthusiast!

      Reply
    7. kn on July 10, 2017 12:56 pm

      On my system, which is Ubuntu 16.04.2, the ctime, mtime, and crtime come-up the same when I run your debugfs command. The atime field is also incorrect.

      However, did find a script that is supposed to output the correct crtime. Here’s the link:

      https://unix.stackexchange.com/a/92748

      Will check-it and post back the results.

      Reply

    Leave A Reply Cancel Reply

    Recent Posts
    • How to Install Sublime Text 4 on Ubuntu 22.04
    • How to Enable / disable Firewall in Windows
    • How to Install JAVA on Ubuntu 22.04
    • Switching Display Manager in Ubuntu – GDM, LightDM & SDDM
    • Changing the Login Screen Background in Ubuntu 22.04 & 20.04
    Facebook Twitter Instagram Pinterest
    © 2022 Tecadmin.net. All Rights Reserved | Terms  | Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.