In Linux systems, everything is treated like a file and crucial metadata about a file such as the creation and modification date are stored in inodes. We have already looked at how you can check the last modified date of a file in Linux system using the stat, httpie and date commands.
In this tutorial, we will show you how to find file creation time using debugfs command.
Find file creation using debugfs
To get the creation time, you first need to find the inode number of the target file using the stat command. The stat command is a command-line tool used to print detailed information about a file’s metadata such as:
- File size
- Inode number
- UID & GID of the file
- I/O Block
- Access, modification and change times.
You can use the stat command in its basic form to check the inode number of the file using the syntax:
$ stat filename
$ stat file1.txt
The command gives us the inode number of the file ‘file1.txt‘ as 1078474. To skip all the other information and just display the inode number alone, use the syntax:
$ stat -c %i file_name
$ stat -c %i file1.txt
Once you have the inode number, you can proceed to easily get the file creation time using the debugfs command using the syntax shown:
$ sudo debugfs -R 'stat <inode number>' DEVICE
The DEVICE represents the block device where your file resides for example /dev/sda1, /dev/sda2 etc. To check the block device run the command:
Using the inode number we got earlier on, the command will therefore be:
$ sudo debugfs -R 'stat <1078474>' /dev/sda
The creation time is prefixed by the directive crtime: as shown in the output above. We can see that the file was created on the 13th Fri December 2019 at 01:39:18 hrs.
Alternatively, instead of specifying the inode number, you can pass the full path to the file as shown:
$ sudo debugfs -R 'stat /home/winnie/file1.txt' /dev/sda1
The above command will yield the same results as when you are using the inode number.
And this wraps up this tutorial, hoping Linux would have straight forward command to find file creation time. We have shown you how to check the creation time of a file using the debugfs command.