On Linux systems, everything is treated as a file, and important metadata about the file, such as creation and modification date, is stored in inodes.
We have already covered how to check the last modified date of a file on Linux using stat, httpie and date commands:
🐧 How to find out the last modified date of a file on Linux
How to find the creation time of a file using debugfs
To find out the creation time of a file, you first need to find the inode number of the target file using the stat command.
The stat command is a command line tool used to display detailed information about the metadata of a file, for example:
- file size
- Inode number
- File UID and GID
- I / O block
- Access times, modifications and changes.
🐧 50 Essential Linux Interview Questions | Questions and answers
You can use the stat command in its basic form to check the inode number of a file using the syntax:
$ stat filename
$ stat file1.txt
The command gives us the inode number of the subdomain.list file – Inode: 951356
To skip all other information and just display only the inode number, use the syntax:
$ stat -c %i file_name
$ stat -c %i file1.txt
Once you have the inode number, you can easily navigate to getting the file creation time with the debugfs command using the syntax shown:
$ sudo debugfs -R 'stat <inode number>' DEVICE
DEVICE is the block device that contains your file, for example / dev / sda1, / dev / sda2, etc. To check the block device, run the command:
Using the inode number we got earlier, the command looks like this:
$ sudo debugfs -R 'stat <951356>' /dev/sda
The creation time is shown by the crtime: directive as shown in the output below:
We can see that the file was created on 14th Oct 2020 at 11:48:19
Alternatively, instead of specifying the inode number, you can pass the full path to the file, as shown here:
$ sudo debugfs -R 'stat /home/itsecforu/file1.txt' /dev/sda1
The above command will give the same results as using the inode number.
And that’s where we wrap up this tutorial, hoping that someday Linux will have a simple command to determine when a file was created.
Here we used the debugfs command to check the creation time of the file.