How to find when a Linux file is created (Super Geeky Stuff)

In Linux systems, the whole lot is dealt with like a document and essential metadata approximately a document consisting of the advent and modification date are saved in inodes. In this tutorial, we can display you the way to locate document creation time with the usage of debugfs command.

Find file creation time

To get the advent time, you first want to locate the inode quantity of the goal document by using the stat command. The stat command is a command-line tool used to print distinct statistics about a document‘s metadata such as:

• File size
• Inode quantity
• UID & GID of the document
• I/O Block Access,
• change and extrade times

You can use the stat command in its primary shape to test the inode quantity of the document the use of the syntax:

$ stat filename

For example:

$ stat file1.txt

The command offers us the inode variety of the file ‘file1.txt’ as 1078474. To bypass all of the different records and simply show the inode variety alone, use the syntax:

$ stat -c %i file_name

For example:

$ stat -c %i file1.txt

Once you’ve got got the inode number, you may continue to effortlessly get the document introduction time the use of the debugfs command the use of the syntax shown:

$  sudo debugfs -R 'stat <inode number>' DEVICE

The DEVICE represents the block tool wherein your document is living for example /dev/sda1, /dev/sda2 etc. To take a look at the block tool run the command:

$ lsblk

Using the inode variety we were given earlier on, the command will consequently be:

$  sudo debugfs -R 'stat <1078474>' /dev/sda

The advent time is prefixed through the directive crtime: as proven withinside the output above. We can see that the record became created at the 13th Fri December 2019 at 01:39:18 hrs. Alternatively, rather than specifying the inode number, you may pass the overall direction to the record as shown:

$  sudo debugfs -R 'stat /home/winnie/file1.txt' /dev/sda1

The above command will yield the equal effects as while you are the usage of the inode number.

Conclusion

And this wraps up this tutorial, hoping Linux might have a simple command to discover record advent time. Here we’ve got used debugfs command to test the advent time of a record.

Tags: