📁 How to find out the creation time of a file on Linux using Debugfs

On Linux systems, everything is treated as a file, and important metadata about the file, such as creation and modification date, is stored in inodes.

We have already covered how to check the last modified date of a file on Linux using stat, httpie and date commands:

🐧 How to find out the last modified date of a file on Linux

How to find the creation time of a file using debugfs

To find out the creation time of a file, you first need to find the inode number of the target file using the stat command.

The stat command is a command line tool used to display detailed information about the metadata of a file, for example:

  • file size
  • Inode number
  • File UID and GID
  • I / O block
  • Access times, modifications and changes.

🐧 50 Essential Linux Interview Questions | Questions and answers

You can use the stat command in its basic form to check the inode number of a file using the syntax:

$ stat filename

For instance:

$ stat file1.txt

📁 How to find out the creation time of a file on Linux using Debugfs

The command gives us the inode number of the subdomain.list file – Inode: 951356

To skip all other information and just display only the inode number, use the syntax:

$ stat -c %i file_name

For instance:

$ stat -c %i file1.txt

Once you have the inode number, you can easily navigate to getting the file creation time with the debugfs command using the syntax shown:

$  sudo debugfs -R 'stat <inode number>' DEVICE

DEVICE is the block device that contains your file, for example / dev / sda1, / dev / sda2, etc. To check the block device, run the command:

$ lsblk

Using the inode number we got earlier, the command looks like this:

$  sudo debugfs -R 'stat <951356>' /dev/sda

The creation time is shown by the crtime: directive as shown in the output below:

📁 How to find out the creation time of a file on Linux using Debugfs

We can see that the file was created on 14th Oct 2020 at 11:48:19

Alternatively, instead of specifying the inode number, you can pass the full path to the file, as shown here:

$  sudo debugfs -R 'stat /home/itsecforu/file1.txt' /dev/sda1

The above command will give the same results as using the inode number.

Conclusion

And that’s where we wrap up this tutorial, hoping that someday Linux will have a simple command to determine when a file was created.

Here we used the debugfs command to check the creation time of the file.

Sidebar