How to Determine File Creation Date in Linux

In various scenarios, determining the file creation date on a Linux system is crucial, be it for administrative purposes, auditing, or tracing file origins. Linux, by default, does not store the creation time, but there are workarounds to retrieve or approximate this information. This article underscores exploring methods and commands that help ascertain a file’s inception date. This walkthrough will shed light on employing commands like stat, debugfs, and utilizing filesystems with inherent capabilities to track file creation dates, providing a well-rounded approach to meeting your file auditing requirements in a Linux environment.

Why Checking File Creation Dates in Linux Matters

Checking the file creation date in Linux can serve various practical purposes. Here are at least five reasons why this might be necessary or beneficial:

1. Auditing and Compliance. In many organizational and legal settings, auditing file access, modification, and creation is a crucial part of compliance with internal or external policies. Being able to verify the creation date of a file can provide essential data for auditing processes.
2. Data Forensics. In case of a security incident or investigation, knowing the creation date of a file can be a critical piece of evidence. It helps in tracing back the actions performed on the system and identifying potentially malicious activity
3. Data Management. Understanding when a file was created can help in organizing, archiving, or deleting old or outdated files, aiding in efficient data management and freeing up storage resources.
4. Backup and Restoration. Knowing the creation dates of files can help in prioritizing backup strategies, ensuring that critical or recent files are backed up, and old or irrelevant files are excluded.
5. Troubleshooting and System Administration. When troubleshooting system issues, knowing when a file was created might help in identifying changes that could have impacted system behavior. This information can be invaluable for system administrators in understanding the system’s history and diagnosing issues.

How to Check File Creation Date in Linux

Here are the detailed steps to find the file creation date in Linux:

#1 Checking Filesystem Support

First, it’s essential to check whether your filesystem supports recording file creation times. For instance, ext4 filesystems have this capability.

tune2fs -l /dev/sda1 | grep 'Filesystem features'

Sample output:

Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize

Look for crtime feature in the output. If it’s present, your filesystem supports storing creation time.

#2 Using the stat command

The stat command can provide the birth time of a file if the filesystem supports it.

stat filename

Sample output:

File: ‘filename’
Size: 123            Blocks: 8          IO Block: 4096   regular file
Device: fc01h/64513d    Inode: 528738      Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/ username)   Gid: ( 1000/ username)
Access: 2023-09-29 13:14:28.303775409 +0200
Modify: 2023-09-29 13:14:28.303775409 +0200
Change: 2023-09-29 13:14:28.303775409 +0200
Birth: -

Look for the Birth field in the output but if it’s not supported, it will display a -.

#3 Using debugfs command

You can use the debugfs command if the stat command doesn’t provide the creation time.

sudo debugfs -R 'stat <inode_number>' /dev/sda1

Sample output:

Inode: 528738   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 3932229572    Version: 0x00000000:00000001
User:  1000   Group:  1000   Size: 123
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x6154894c:acd3b6c0 -- Tue Sep 29 13:14:36 2023
atime: 0x6154894c:acd3b6c0 -- Tue Sep 29 13:14:36 2023
mtime: 0x6154894c:acd3b6c0 -- Tue Sep 29 13:14:36 2023
crtime: 0x6154894c:acd3b6c0 -- Tue Sep 29 13:14:36 2023

Look for the crtime field in the output for the creation time.

#4 Exploring Other Filesystems

If possible, consider using filesystems like Btrfs or ZFS that store file creation times natively.

That’s it! Now you’re able to determine the file creation date in Linux. The steps above outline different methods to ascertain this information. Although Linux doesn’t store file creation dates by default, certain filesystems and commands can assist in retrieving this crucial data when necessary. The stat and debugfs commands, coupled with the exploration of alternative filesystem options like Btrfs or ZFS, can be instrumental in determining file creation dates for various auditing or administrative purposes.”

Conclusion

Looking to deploy Linux in the cloud? With Gcore Cloud, you can choose from Basic VM, Virtual Instances, or VPS/VDS suitable for Linux:

• Gcore Basic VM offers shared virtual machines from €3.2 per month
• Virtual Instances are virtual machines with a variety of configurations and an application marketplace
• Virtual Dedicated Servers provide outstanding speed of 200+ Mbps in 20+ global locations

Choose an instance