How to Find Out File Creation Date and Time on Linux

Couldn’t find out the File Creation Date and Time on Linux?

Knowing the precise date and time of the file makes it easy to organize and troubleshoot while also offering valuable insights through its timestamp.

Thankfully, Linux offers several ways to retrieve this information which we will go over below.

Let’s dive right in!

Why Find a File’s Creation Date and Time in Linux?

In Linux, the creation time marks a file’s initial creation and stays unchanged, even with modifications. 

It’s vital for backups, identifying duplicates, and spotting untouched files.

Here are some of the reasons why finding file creation date and time is crucial:

• Pinpointing the original state for accurate backups
• Identifying potential duplicate files
• Discovering files untouched since their creation
• Assisting in system audits and security checks
• Facilitating digital forensic investigations
• Enhancing data management and organization

If you’re here for any of the above reasons, proceed with the methods below to find the file creation date and time on Linux.

How to Find Out File Creation Date and Time on Linux: 3 Ways

1.  Use the “Stat” Command

The stat command in Linux provides detailed information about files, including their creation time. 

Here’s how to use the stat command to access details about the file’s creation date and time:

1. Start by accessing your Linux terminal from the applications menu or using a shortcut.
2. Once the terminal is loaded, enter the following command. Make sure to replace <filename> with the file name you want to check:

stat <filename>

3. Look for the “Birth” or “Create” attribute in the output, which indicates the file’s creation date and time, respectively:

2. Use the debugfs Command

If your file system is ext2, ext3, or ext4, then it’s necessary to use the debugfs command.  debugfs serves as a file system debugger and provides flexibility with ext file systems.

Here’s how to use the debugfs command to access details about the file’s creation date and time:

Step 1: Find the Inode Number

1. Start by opening the terminal through the applications menu or the shortcut.
2. After the terminal is loaded, enter the following command that uses the ls command with the -i option followed by the file path to get the inode number. Make sure to replace /path/to/your/file with the path where your file is located. If you find it confusing, head to the current path and enter the file name instead of the path.

ls -i /path/to/your/file

3. Now note down the Inode number, which refers to the physical file stored in a particular location, and proceed to the next step. Ensure you have noted the right Inode number to prevent gathering wrong information.

Step 2: Get the File Creation Time and Date

1. In the terminal, enter the below command that uses the debugfs command with the -R option followed by the stat command and the inode number. Make sure to replace <inode_number> with the inode number you generated in the previous step:

sudo debugfs -R 'stat <inode_number>' /dev/sda1

2. Unlike the stat command, the attributes have a few changes while using the debugfs command. Refer to the crtime attribute, as shown in the screenshot below, to find the file creation date and time:

Note: For this method to work, it is necessary to have all permissions to access the file and that the file system supports the debugfs command.

3. Use the ls Command

The ls command is one of Linux’s most commonly used commands for listing directory contents. Its functionalities are not limited to listing content but are used for many purposes.

Here are steps to use the ls command to get information about the file creation date and time:

1. Similar to the above methods, open the terminal to enter the commands.
2. For the ls command to work, navigate to the directory where your file is located. Enter the below command to change your directory:

cd /path/to/directory/

Note: If the current directory and the directory where the file is located are the same, you can skip this step.

3. Once the directory file is located, enter the following command to display the creation date and time of a file. Make sure to replace filename with the file name you want to check:

ls -l --time=creation filename

4. On running the command, you’re displayed with a line, as shown in the screenshot below, featuring the creation date and time of the file:

Method 4: Use the “Properties” Option

This method is arguably the easiest and is similar to Windows as both feature the “Properties” option. We suggest this method to beginners as it involves the use of GUI. 

Here are steps to get information about the file creation date and time using the “Properties” option:

1. Start by navigating to the folder where the file is present.
2. Once you have located the file, right-click on it to see its associated options. From these options, click on Properties.

3. Doing so opens the Properties window. Under the basics section, you will find the attribute “Created“, which features the time and date the file was created:

Conclusion

Congratulations on successfully finding out the file creation date and time on Linux!

Through this article, you’ve learned the significance of file creation timestamps and explored multiple methods to retrieve this information–from using terminal commands like stat, debugfs, and ls to the more beginner-friendly, GUI-based “Properties” option.

If you’re stuck on any method, refer to the documentation of your Linux distribution or the community forums.