41

Are there any (good known, reliable) file systems on Linux that store the creation time of files and directories in the i-node table?

If there are, is the "changed" time replaced by the creation time of an i-node in a stat call?

franziskus
  • 875

4 Answers4

44

Several file systems store the file creation time, although there is no standard name for this field:

  • ufs2 → st_birthtime
  • zfs → crtime
  • ext4 → crtime
  • btrfs → otime
  • jfs → di_otime
jlliagre
  • 61,204
  • 7
    To be explicit, as of 2015-03, XFS don't support (see xfs_db manpage or in XFS File System Structure – Franklin Piat Mar 28 '15 at 13:54
  • 3
    Just months after the prior comment from @FranklinPiat, XFS v5 did gain crtime: https://git.kernel.org/pub/scm/fs/xfs/xfs-documentation.git/tree/design/XFS_Filesystem_Structure/ondisk_inode.asciidoc — however, it appears that some kernels capable of XFS v5 mounting did not support crtime: https://unix.stackexchange.com/questions/306442/how-to-check-xfs-filesystem-version – Trey Feb 04 '21 at 18:22
  • 1
    xfs crtime still not visible using gnome nautilus or stat on some distros but later KDE Dolphin will typically show it: https://www.phoronix.com/scan.php?page=news_item&px=KDE-Finally-File-Creation-Times – Bob Jun 04 '22 at 11:22
21

The ext4 file system does store the creation time. stat -c %W myfile can show it to you.

Franklin Piat
  • 3,021
Keith
  • 7,914
  • 1
  • 28
  • 29
  • 8
    Thanks. In my system stat -c %W returns 0 (creation time unknown), but that is another question... – franziskus Feb 17 '11 at 06:30
  • 1
    But note that due to how files are handled by many programs, that creation time value may not be useful. – mattdm Feb 17 '11 at 15:27
  • @mattdm: What do you mean? – Christoph Wurm Feb 20 '11 at 11:51
  • 16
    @Legate: if a text editor works by copying the file to a temporary location, editing the temporary working copy, and then moving the temporary copy over the original on save, when is the creation time? – mattdm Feb 20 '11 at 14:02
  • 2
    Does this need to be enabled somehow? I tried to get the crtime for a file on an ext4 filesystem and got zero. Having previously read this blog post, I also tried using debugfs and stat which revealed that there is no crtime. So I wonder if it needs to be enabled somehow? (FWIW I use Arch Linux) – starfry Apr 17 '18 at 08:20
  • 2
    @starfry there is currently no way for userspace to obtain the creation time of a file under Linux. stat -c %W presumably works on (some) BSDs, but it can’t output non-0 on Linux. – Stephen Kitt Aug 28 '18 at 15:57
  • 3
    There does seem to be a way to get the file creation time in Linux. See: https://unix.stackexchange.com/a/131347/182996 – kaartic Oct 24 '18 at 08:02
  • This answer is somewhat misleading. Perhaps update it, e.g., based on the comments? – Peter Mortensen Jul 23 '23 at 16:04
4

As far as I know ext4, JFS and BTRFS file systems all support an extra field in the files inode to store the creation time, though the naming might differ.

Source: LWN File Creation Times

Huygens
  • 9,345
  • 1
    // , Have you been able to verify this? AFAIK is sort of weak, for my taste, at least. – Nathan Basanese Aug 21 '15 at 19:24
  • 5
    @NathanBasanese The AFAIK was reporting to JFS and BTRFS. For ext4, yes it supports it. Check debugfs command stat. Exemple: you need to thing the device where you ext4 filesystem is mounted (e.g. /dev/sda3) and you need to get a file inode number within that file system (use ls -i, let say 42000 is the number), then you simply type: debugfs -R 'stat <42000>' /dev/sda3. Run this as root, or with enough privilege. Look for the crtime field, that's the one. For JFS and BTRFS, you would need to find the equivalent debugfs command... – Huygens Aug 21 '15 at 22:15
  • // , NIIICE. I tried $ ls -i | grep dump.rdb 656376 dump.rdb and $ sudo debugfs -R 'stat <656376>' /dev/sda2, but I think I don't have ext4 on there, yet. If I try it on an ext4, I'll say so. – Nathan Basanese Aug 21 '15 at 23:10
  • @NathanBasanese You can do df -T to get the partition type or simply type mount. Make sure that the file inode belong to the correct partition. Inodes are (per their nature) specific to a partition. – Huygens Aug 22 '15 at 20:27
4

xfs v5 supports crtime

# dmesg | grep -iE 'xfs.*\s+mounting' | head -1
[   10.939721] XFS (dm-1): Mounting V5 Filesystem

shows using V5. Then get file inode number ;

# stat -c '%i' test.txt
68227195

Then get crtime ;

# xfs_db -r -c "inode 68227195" -c "p v3.crtime.sec" <device eg. /dev/mapper/rl-root>
v3.crtime.sec = Mon Jun  6 15:13:02 2022

or on one line:

xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" <device>

EDIT

...an easier way;

use stat <filename> for the same result returned as "Birth"

[root@wsa test]# pwd
/root/test

[root@wsa test]# ls
total 8.0K
67109562    0 drwxr-xr-x.  2 root root   22 Mar 22 00:07 .
     133 4.0K dr-xr-x---. 19 root root 4.0K Mar 21 23:54 ..
67552174 4.0K -rw-r--r--.  1 root root   10 Mar 22 00:07 test.txt


[root@wsa test]# df .
Filesystem          1K-blocks     Used Available Use% Mounted on
/dev/mapper/al-root 104806400 25289868  79516532  25% /


[root@wsa test]# xfs_db -r -c "inode $(stat -c '%i' test.txt)" -c "p v3.crtime.sec" /dev/mapper/al-root
v3.crtime.sec = Tue Mar 21 23:55:55 2023


[root@wsa test]# stat test.txt
  File: test.txt
  Size: 10              Blocks: 8          IO Block: 4096   regular file
Device: fd01h/64769d    Inode: 67552174    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2023-03-22 00:07:38.926108379 +0000
Modify: 2023-03-22 00:07:55.794041676 +0000
Change: 2023-03-22 00:07:55.794041676 +0000
 Birth: 2023-03-21 23:55:55.413859045 +0000

performed with;

Operating System: AlmaLinux 8.7 (RHEL clone)
Kernel Version: 4.18.0-425.13.1.el8_7.x86_64 (64-bit)

[root@wsa test]# stat --version
stat (GNU coreutils) 8.30
Copyright (C) 2018 Free Software Foundation, Inc.


[root@wsa test]# xfs_db -r /dev/mapper/al-root
xfs_db> version
versionnum [0xb4b5+0x18a] = V5,NLINK,DIRV2,ATTR,ALIGN,LOGV2,EXTFLG,MOREBITS,ATTR2,LAZYSBCOUNT,PROJID32BIT,CRC,FTYPE,FINOBT,SPARSE_INODES,REFLINK
Bob
  • 183
  • thanks for sharing this - it was not an immediate search result it might be worth x-posting on https://stackoverflow.com/q/31233316/490487 ? – Kyle Jan 26 '23 at 12:56
  • stat 8.22 does not read crtime on RH7: stat gives Birth : - but xfs_db gives v3.crtime.sec = Tue Apr 11 12:58:52 2023 – Mat M Jul 21 '23 at 17:19