How to view file creation date in Linux

On a Linux system, the file properties of a file in the file manager show only information about the date of the last access to the file and the date of modification. But the creation date is not shown there. Sometimes you need to look at it, for example, to find out when the log is being recorded. In this instruction we will tell you how to see what data is stored in Linux file systems and explain how to find out the creation date of a Linux file. Two convenient ways will be mentioned at once, each with its own peculiarities.

File creation date

The POSIX standard specifies only 3 types of timestamps that a file system must store:

• atime - the time of the last access to the file.
• mtime - time of the last modification of the content.
• ctime - time of the last modification of access rights or owner.

That is why in old file systems it is often impossible to see information about the date of file creation. But in modern file systems (ext4, zfs, XFS and so on) it is already stored.

Data about the creation date is recorded in a special field:

• Ext4 - crtime
• ZFS - crtime
• XFS - crtime
• Btrfs - otime
• JFS - di_otime

There are two methods of viewing this information: using the stat utility and debugfs. However, the first method is not suitable for users of every Linux distribution. The second method is universal, but not so easy to use. Let's deal with each of them separately.

Using Stat

The stat utility displays detailed information about a file. Among other things, it displays the date of creation of the Linux file. To run it in the terminal, you just need to specify the path to the file. For example, let's look at the information about the image pic_1.jpeg stored in the /home/root-user/Pictures directory:

$ stat /home/root-user/Pictures/pic_1.jpeg

The necessary information is written in the Created column. And by using the -c option you can set certain formatting rules for the information output, for example, leaving only the necessary column:

$ stat -c '%w' /home/root-user/Pictures/pic_1.jpeg

But there is one small difficulty. On some Linux distributions, when using the stat utility, this field will be empty.

The main reason is that the output is displayed in statx(2). The shell was added to the glibc library in version 2.28. That is, support for this shell appeared in the GNU coreutils 8.31 set of basic system utilities. To check the version, run this command:

$ stat --version

Consequently, stat will only be able to output file creation data if the specific conditions described above are present. For example, in Ubuntu 21.10 distribution everything works without any problems, but in Ubuntu 20.04 the field will be empty.

Using DebugFS

The DebugFS utility has no version restrictions. It will always work. But its usage procedure is a bit more complicated. This is because in order to view the creation date of a file via debugfs, you need to know its inode number and file system. To get the inode, use the ls command with the -i option, specifying the path to the file:

$ ls -i /home/root-user/scripts/main_script.txt

To view the file system, the df command will come in handy:

$ df /home/root-user/scripts/main_script.txt

Now you have all the necessary data and you can move on to the debugfs utility. You need to pass the -R option to it, specify the inode number and then the name of the file system:

$ sudo debugfs -R 'stat <28>' /dev/sda5

After that, you will be able to find in the terminal the field where the creation date is stored. In our case it is crtime.

This completes the instructions.