Most Linux administrators are aware of the three standard timestamps associated with a file, i.e. ctime, atime and mtime. What you may not be aware of is that many of the modern filesystems on Linux such as EXT4 and BTRFS also support a file creation timestamp.
Here is what the stat command outputs on RHEL 6.4:
# stat helloworld File: `helloworld' Size: 6470 Blocks: 16 IO Block: 4096 regular file Device: 803h/2051d Inode: 396942 Links: 1 Access: (0775/-rwxrwxr-x) Uid: ( 500/ fpm) Gid: ( 500/ fpm) Access: 2014-05-14 06:30:45.107878096 -0700 Modify: 2014-05-14 06:30:36.337878203 -0700 Change: 2014-05-14 06:30:36.337878203 -0700
and here is what stat outputs on RHEL 7:
# stat test File: ‘test’ Size: 13644 Blocks: 32 IO Block: 4096 regular file Device: fd00h/64768d Inode: 71265538 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Context: unconfined_u:object_r:user_home_t:s0 Access: 2014-06-13 19:03:06.695700366 -0400 Modify: 2014-06-13 19:03:03.655583791 -0400 Change: 2014-06-13 19:03:03.655583791 -0400 Birth: -
Note the empty Birth line. For some crazy reason, there is controversy in the Linux community on whether to label a file creation timestamp as a birth timestamp or a creation timestamp. This argument has been going on since circa 2010 and, as a result, Torvalds basically has punted adding file creation time support in the Linux kernel until at least 2015.
So how can you retrieve the creation date of file on an EXT4 filesystem? Well, you can write your own utility to do it or you can use debugfs as shown in the following example:
# debugfs debugfs 1.41.12 (17-May-2010) debugfs: open /dev/sda3 debugfs: cd home/fpm debugfs: stat helloworld Inode: 396942 Type: regular Mode: 0775 Flags: 0x80000 Generation: 1850782189 Version: 0x00000000:00000001 User: 500 Group: 500 Size: 6470 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 16 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x53736ffc:508e72ec -- Wed May 14 06:30:36 2014 atime: 0x53737005:19b85b40 -- Wed May 14 06:30:45 2014 mtime: 0x53736ffc:508e72ec -- Wed May 14 06:30:36 2014 crtime: 0x53736ffc:38b6eee4 -- Wed May 14 06:30:36 2014 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "unconfined_u:object_r:user_home_t:s0 00" (37) EXTENTS: (0-1): 1620740-1620741
Here, the file creation time is labeled crtime which is at least a saner label than the stat Birth label.
