In Linux, the creation time refers to when a file is first created on a file system, and it remains unchanged even if the file is modified or its metadata is updated. It has significant importance to determine when a file was first created so that the backup can be restored to the correct state. Also, it identifies duplicate files or finds files that have not been accessed or modified since they were created.
This guide will illustrate various methods to get the file created/creation time on Ubuntu.
- Method 1: Use the “stat” Command
- Method 2: Use the “debugfs” Command
- Method 3: Use the “ls” Command
- Method 4: Use the “Properties” Option | GUI Option
Method 1: Use the “stat” Command
The “stat” command is utilized to get the file creation time in Linux. It displays information about a file or a file system, including the file creation time. First, understand the syntax:
Syntax:
$ stat [File Name or Path]
Use the file name and the path of the file whose creation time is to be checked.
Example:
Run the “stat” command specified by the file name. For instance, the file is named “file.txt” to get creation time:
$ stat file.txt
It displays the information about the file, including the file creation time such as “2023-02-19 07:10:49.130430637”.
Method 2: Use the “debugfs” Command
If the file system is ext2, ext3, or ext4, use the “debugfs” command to get the file creation time. Before using this command, let’s have a look at the syntax:
Syntax:
$ debugfs -R 'stat <inode_number>' partition_name
In the above syntax, the “inode_number” specifies the tracking id of the file which users want to get the creation time and “partition_name” identifies the partition where the particular file is located.
Example:
The step-by-step instructions are provided below to get the file creation time:
Step 1: Find the Inode Number
First, find the inode number of the file using the “ls -i” command by specifying the file name as “file.txt”:
$ ls -i file.txt
It returns the inode number “534723” of the “file.txt” file.
Step 2: Get File Created/Creation Time
To get the file creation time, utilize the “debugfs” command with the “R” option. After that, mention the inode number and partition of the specified file. In our case, the inode number is “534723” and the partition is “/dev/sda3”:
$ sudo debugfs -R 'stat <534723>' /dev/sda3
The output returns several timestamps, including “crtime”, which is the file creation time of “file.txt”.
Note: To find the partitions of the machine, execute the “sudo fdisk -l” command.
Method 3: Use the “ls” Command
The “ls” command can display the time of the last metadata change (ctime) for a file. In most cases, it may be the file creation time.
Syntax
$ ls --time=ctime -l filename
In the above syntax, the “ctime” is the timestamp of the file creation time, and “filename” specifies the name of the file which users want to get the creation time.
Example
To display the file creation time, run the “ls –time=ctime” command by specifying the file name “file.txt”:
$ ls --time=ctime -l file.txt
The output returns the ctime “Dec 12 04:42”, which is the file creation time of “file.txt”.
Method 4: Use the “Properties” Option | GUI Method
To check the file creation time, utilize the “Properties” option after pressing the right button on the specified file or the “CTRL+I” shortcut key:
It pops up a new window, see the “Created” section that contains the creation time of the specified file such as “file.txt”:
The output shows that the “file.txt” has the “Mon 12 Dec 2022 04:43:31 AM EST” created time in Linux.
Note: The last method depends on the availability of the GUI on the Linux system.
Conclusion
To get the file created/creation time in Linux, use the “stat”, “debugfs”, “ls” commands, and “Properties” options in GUI. They display the information regarding the file, including the file creation time. Users can utilize it to track the age of files and to automate file management tasks based on their age.
This guide has illustrated all possible methods to get the file created/creation time in Linux.
