How to find file creation time (crtime) in Linux

The file creation time is stored in the inode of the ext4 file system. Earlier versions of the ext file system did not support file creation time. There is a crtime (creation time) timestamp in the debugfs stat output. Finally, ext4 supports creation time, just like btime in ntfs windows.

You can follow the instructions below to find the file creation time. For example, I'm using one to select an existing file or create a new file for testing. For this file.

Step 1: Find the inode file number

First, use the following command on the terminal to find the inode number of any file.

$ ls -i /var/log/secure
13377/var/log/syslog

Step 2: Find the file creation time (crtime)

After obtaining the inode number of the file, use the debugfs command with inode number statistics to follow the disk path.

$ debugfs -R &#39;stat <inode_number>&#39; /dev/sda1

Execute

$ debugfs -R &#39;stat <13377>&#39; /dev/sda1

debugfs 1.41.12 (17-May-2010)
Inode: 13377   Type: regular    Mode:  0600   Flags: 0x80000
Generation: 2326794244    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 223317
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 440
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
 atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
 mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011
Size of extra inode fields: 28
Extended attributes stored in inode body:
  selinux = "system_u:object_r:var_log_t:s000" (31)
EXTENTS:
(0-24): 35008-35032, (25-54): 164224-164253

Find the entry for crtime in the above output, which is the actual file creation time.

This article has ended here. For more exciting content, you can pay attention to other related column tutorials on the PHP Chinese website! ! !

The above is the detailed content of How to find file creation time (crtime) in Linux. For more information, please follow other related articles on the PHP Chinese website!