How can I view the creation date of a file in Linux

In this article we will teach you how to get the crtime, or CReation Time, which is the dates of access, modification and creation of a file on a GNU / Linux system.

Note that you will only be able to know the creation date of a file in Linux if the filesystem is created as EXT4. If, on the contrary, it is earlier, it is not possible to know this data.

Before starting, to find out if the file system is EXT4, we need to insert the df-T command in the file. Once this is confirmed, we proceed to consult and view the date of creation of a file in Linux.

If in the directory we get a previous output, the middle dash in the field " Birth" it means that the file system we are working in does not support storing the creation date, so it is not possible to view that date.

Therefore, it happens that the user space tools are not able to get this information correctly, at least in previous versions.

How to view the creation date of a Linux file in just a few steps

When we use operating systems like Linux, every component inside it is labeled as a file and every time we make a change to one of them, they are saved in an inode.

To get the INODE_NUMBER, that is the number of inodes found inside the file, we have to look for it as follows: is-i-file. With it we can get the number of inodes we need to use in the next command.

Linux is responsible for differentiating and selecting each file based on its respective inode number, which is not the same name it was created under. The idea is to use the command "Stat" or "Statistics", as the name suggests, to view the status of the file system by creating useful information such as:

• File creation date
• number of inodes
• Changes applied
• Last change of state
• Last access, among others.

To be able to do this, we must start from having as a reference the root of the systems that contains the file to be revised. On Linux they exist with parameters like

• Ctime, which shows the time of change
• Like, generates the access time
• mtime, the modification time
• Crime, the date and time the file was created.

Find the creation date of the file

As we explained earlier, we will use Crtime, to be able to view the creation date and time of a Linux file. Since this parameter is the one in charge of finding the inode of the file, through the command: ~$stat.

To perform this action, we need to go to the directory where the file is located and from there analyze the information displayed, such as the date of the last access and modification, the links, the size, the number of inodes, etc.

Now, with the inode number, we're going to copy and paste into the directory, keeping the brackets as follows: debugfs -R ‘stat ’ /dev/sda1. Where / dev / sda1 is where the drive is mounted. And we can see that in the crtime line we get the date we were looking for.

If instead what you want is to display the modification dates, you have to use the long list option (-the), all file modification dates are shown by default in Linux.

If you also add " -u » what you will get are the dates of the last time the file was opened for reading or editing.

It is so easy to learn how I can view the creation date of a file in Linux. Any question you have, you can leave it in the comment box a little further down.