Difference between revisions of "Linux/Agnostic"

Latest revision as of 03:01, 16 January 2015

Finding out file creation time

Only available on ext4.
Use the stat command - the file creation time will be denoted as the Birth time.

root@milos-debian:~# stat .bashrc
  File: `.bashrc'
  Size: 570             Blocks: 8          IO Block: 4096   regular file
Device: fe01h/65025d    Inode: 391924      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2015-01-16 01:05:05.172328004 +1300
Modify: 2010-02-01 00:52:26.000000000 +1300
Change: 2014-10-27 16:41:41.178458115 +1300
 Birth: -

If it shows up as — (as above), then the stat command does not yet support getting this information from the kernel. Thankfully, you can still get the birth time using debugfs:

debugfs -R 'stat <inode_number>'

The angle quotes, < and >, are required!

Find the file's inode number (ls -li <file>):

root@milos-debian:~# ls -li .bashrc
391924 -rw-r--r-- 1 root root 570 Feb  1  2010 .bashrc

And then use it:

root@milos-debian:~# debugfs -R 'stat <391924>' /dev/vda1
Inode: 391924   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 2468252752    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 570
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x544dbef5:2a8c380c -- Mon Oct 27 16:41:41 2014
 atime: 0x54b7acf1:29161110 -- Fri Jan 16 01:05:05 2015
 mtime: 0x4b656efa:00000000 -- Mon Feb  1 00:52:26 2010
crtime: 0x544dbef5:2a8c380c -- Mon Oct 27 16:41:41 2014
Size of extra inode fields: 28
EXTENTS:
(0):1606693