How to find file creation time (crtime) in Linux

The file creation time is stored in the inode of the ext4 file system. Earlier versions of the ext file system did not support file creation time. There is a crtime (creation time) timestamp in the debugfs stat output. Finally, ext4 supports creation time, just like btime in ntfs windows.

You can follow the instructions below to find the file creation time. For example, I'm using one to select an existing file or create a new file for testing. For this file.

Step 1: Find the inode file number

First, use the following command on the terminal to find the inode number of any file.

$ ls -i /var/log/secure 13377/var/log/syslog

Step 2: Find the file creation time (crtime)

After obtaining the inode number of the file, use the debugfs command with inode number statistics to follow the disk path.

$ debugfs -R 'stat ' /dev/sda1

Execute

$ debugfs -R 'stat <13377>' /dev/sda1 debugfs 1.41.12 (17-May-2010) Inode: 13377 Type: regular Mode: 0600 Flags: 0x80000 Generation: 2326794244 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 223317 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 440 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "system_u:object_r:var_log_t:s000" (31) EXTENTS: (0-24): 35008-35032, (25-54): 164224-164253

Find the entry for crtime in the above output, which is the actual file creation time.

This article has ended here. For more exciting content, you can pay attention to other related column tutorials on the PHP Chinese website! ! !

The above is the detailed content of How to find file creation time (crtime) in Linux. For more information, please follow other related articles on the PHP Chinese website!