Monday, November 15, 2010

Finding file creation time in Linux

Question:  In Linux, is it possible to find the actual time when a file was created first?

The Answer is NO until Ext3

File creation time ISN’T maintained in Linux with file-system Ext3 or earlier version. 
It will change when file content changes. It is explained with an example here:


[adevaraju@cac1-t1 ~]$ date
Tue Nov  9 01:22:25 CST 2010                                                      # Time now is 01:22:25
[adevaraju@cac01-t1 ~]$ echo "Some text on the file " > testfile       # Creating a file
[adevaraju@cac01-t1 ~]$ ls -lc testfile
-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Shows file change time as 01:22
 [adevaraju@cac01-t1 ~]$ ls -lu testfile
-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Access time is also 01:22

[adevaraju@cac01-t1 ~]$ cat testfile                                       # Now am accessing the file
Some text on the file

 [adevaraju@cac01-t1 ~]$ ls -lc testfile                            
-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Change time remains the same
[adevaraju@cac01-t1 ~]$ ls -lu testfile
-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:23 testfile     # Access time changed to 01:23
[adevaraju@cac01-t1 ~]$ date
Tue Nov  9 01:23:32 CST 2010

[adevaraju@cac01-t1 ~]$ echo "Additional text to the file" >> testfile # file content changed
 [adevaraju@cac01-t1 ~]$ ls -lc testfile                                                                            
-rw-r--r-- 1 adevaraju domain users 51 Nov  9 01:24 testfile      # Change time changes to 01:24
[adevaraju@cacllm01-t1 ~]$ ls -lu testfile
-rw-r--r-- 1 adevaraju domain users 51 Nov  9 01:23 testfile      # But access time remains the same since we did only changes to file.
[adevaraju@cacllm01-t1 ~]$ date
Tue Nov  9 01:24:22 CST 2010
[adevaraju@cacllm01-t1 ~]$

Atlast the original file creation time (which is 01:22) is gone, we CAN’T retrieve that information.

PS:  EXT4 file-system comes out with a feature to find the File-creation time. 

No comments:

Post a Comment