25 C
Jaipur
Saturday, November 28, 2020

How to Find Linux File Creation Time using Debugfs

Must read

GTA Fans Discovered a Major Hint About GTA VI in New Teaser

It has been quite a while since Rockstar released the last iteration of Grand Theft Auto. But still, the developers are still earning a...

What’s The Difference Between 4WD And AWD? Which One Is Better?

Most people often get confused between all-wheel-drive (AWD) and 4 wheel drive (4WD). People think it’s the same; however, there’s a difference between the...

How to Eject Water From Your iPhone Using Siri Shortcut

I don’t know about you guys, but I am that person who takes his smartphone to the shower to listen to my favorite songs....

In Linux systems, everything is treated like a file and crucial metadata about a file such as the creation and modification date are stored in inodes. We have already looked at how you can check the last modified date of a file in Linux system using the stat,  httpie and date commands. 

In this tutorial, we will show you how to find file creation time using debugfs command.

Find file creation using debugfs

To get the creation time, you first need to find the inode number of the target file using the stat command. The stat command is a command-line tool used to print detailed information about a file’s metadata such as:

  1. File size
  2. Inode number
  3. UID & GID of the file
  4. I/O Block
  5. Access, modification and change times.

You can use the stat command in its basic form to check the inode number of the file using the syntax:

$ stat filename

For example:

$ stat file1.txt

The command gives us the inode number of the file ‘file1.txt‘ as 1078474. To skip all the other information and just display the inode number alone, use the syntax:

$ stat -c %i file_name

For example:

$ stat -c %i file1.txt

Once you have the inode number, you can proceed to easily get the file creation time using the debugfs command using the syntax shown:

$  sudo debugfs -R 'stat <inode number>' DEVICE

The DEVICE represents the block device where your file resides for example /dev/sda1, /dev/sda2 etc. To check the block device run the command:

$ lsblk

Using the inode number we got earlier on, the command will therefore be:

$  sudo debugfs -R 'stat <1078474>' /dev/sda
find file creation time using debugfs

The creation time is prefixed by the directive crtime: as shown in the output above. We can see that the file was created on the 13th Fri December 2019 at 01:39:18 hrs.

Alternatively, instead of specifying the inode number, you can pass the full path to the file as shown:

$  sudo debugfs -R 'stat /home/winnie/file1.txt' /dev/sda1

The above command will yield the same results as when you are using the inode number.

Conclusion

And this wraps up this tutorial, hoping Linux would have straight forward command to find file creation time. We have shown you how to check the creation time of a file using the debugfs command.

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

GTA Fans Discovered a Major Hint About GTA VI in New Teaser

It has been quite a while since Rockstar released the last iteration of Grand Theft Auto. But still, the developers are still earning a...

What’s The Difference Between 4WD And AWD? Which One Is Better?

Most people often get confused between all-wheel-drive (AWD) and 4 wheel drive (4WD). People think it’s the same; however, there’s a difference between the...

How to Eject Water From Your iPhone Using Siri Shortcut

I don’t know about you guys, but I am that person who takes his smartphone to the shower to listen to my favorite songs....

Snapchat Streak Lost? Here Is How To Restore It

I would have deleted Snapchat a long time ago if it wasn’t for the Streaks. The Snapchat feature makes me feel involved in my friends’...