Image of Advanced Programming in the UNIX Environment, Second Edition (Addison-Wesley Professional Computing Series)
Image of Beginning Google Maps API 3
Image of RHCE Red Hat Certified Engineer Linux Study Guide (Exam RH302) (Certification Press)
Image of Android Wireless Application Development

File creation time in EXT4

Most Linux administrators are aware of the three standard timestamps associated with a file, i.e. ctime, atime and mtime. What you may not be aware of is that many of the modern filesystems on Linux such as EXT4 and BTRFS also support a file creation timestamp.

Here is what the stat command outputs on RHEL 6.4:

# stat helloworld
  File: `helloworld'
  Size: 6470      	Blocks: 16         IO Block: 4096   regular file
Device: 803h/2051d	Inode: 396942      Links: 1
Access: (0775/-rwxrwxr-x)  Uid: (  500/    fpm)   Gid: (  500/    fpm)
Access: 2014-05-14 06:30:45.107878096 -0700
Modify: 2014-05-14 06:30:36.337878203 -0700
Change: 2014-05-14 06:30:36.337878203 -0700

and here is what stat outputs on RHEL 7:

# stat test
  File: ‘test’
  Size: 13644     	Blocks: 32         IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 71265538    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2014-06-13 19:03:06.695700366 -0400
Modify: 2014-06-13 19:03:03.655583791 -0400
Change: 2014-06-13 19:03:03.655583791 -0400
 Birth: -

Note the empty Birth line. For some crazy reason, there is controversy in the Linux community on whether to label a file creation timestamp as a birth timestamp or a creation timestamp. This argument has been going on since circa 2010 and, as a result, Torvalds basically has punted adding file creation time support in the Linux kernel until at least 2015.

So how can you retrieve the creation date of file on an EXT4 filesystem? Well, you can write your own utility to do it or you can use debugfs as shown in the following example:

# debugfs
debugfs 1.41.12 (17-May-2010)
debugfs:  open /dev/sda3
debugfs:  cd home/fpm
debugfs:  stat helloworld
Inode: 396942   Type: regular    Mode:  0775   Flags: 0x80000
Generation: 1850782189    Version: 0x00000000:00000001
User:   500   Group:   500   Size: 6470
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 16
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x53736ffc:508e72ec -- Wed May 14 06:30:36 2014
 atime: 0x53737005:19b85b40 -- Wed May 14 06:30:45 2014
 mtime: 0x53736ffc:508e72ec -- Wed May 14 06:30:36 2014
crtime: 0x53736ffc:38b6eee4 -- Wed May 14 06:30:36 2014
Size of extra inode fields: 28
Extended attributes stored in inode body:
  selinux = "unconfined_u:object_r:user_home_t:s000" (37)
(0-1): 1620740-1620741

Here, the file creation time is labeled crtime which is at least a saner label than the stat Birth label.

Comments are closed.