In Linux systems, the whole lot is dealt with like a document and essential metadata approximately a document consisting of the advent and modification date are saved in inodes. In this tutorial, we can display you the way to locate document creation time with the usage of debugfs command.
Find file creation time
To get the advent time, you first want to locate the inode quantity of the goal document by using the stat command. The stat command is a command-line tool used to print distinct statistics about a document‘s metadata such as:
- File size
- Inode quantity
- UID & GID of the document
- I/O Block Access,
- change and extrade times
You can use the stat command in its primary shape to test the inode quantity of the document the use of the syntax:
$ stat filename
$ stat file1.txt
The command offers us the inode variety of the file ‘file1.txt’ as 1078474. To bypass all of the different records and simply show the inode variety alone, use the syntax:
$ stat -c %i file_name
$ stat -c %i file1.txt
Once you’ve got got the inode number, you may continue to effortlessly get the document introduction time the use of the debugfs command the use of the syntax shown:
$ sudo debugfs -R 'stat <inode number>' DEVICE
The DEVICE represents the block tool wherein your document is living for example /dev/sda1, /dev/sda2 etc. To take a look at the block tool run the command:
Using the inode variety we were given earlier on, the command will consequently be:
$ sudo debugfs -R 'stat <1078474>' /dev/sda
The advent time is prefixed through the directive crtime: as proven withinside the output above. We can see that the record became created at the 13th Fri December 2019 at 01:39:18 hrs. Alternatively, rather than specifying the inode number, you may pass the overall direction to the record as shown:
$ sudo debugfs -R 'stat /home/winnie/file1.txt' /dev/sda1
The above command will yield the equal effects as while you are the usage of the inode number.
And this wraps up this tutorial, hoping Linux might have a simple command to discover record advent time. Here we’ve got used debugfs command to test the advent time of a record.
|debugfs, debugfs linux, mount debugfs, linux find file, date time, linux time, ubuntu, debian, security|