In Linux or any Unix flavors, file-creation time isn't maintained. It will get change when the file-content changes. I tested and confirmed this 1.5 years before and shared my test results in this post.
http://ashok-linux-tips.blogspot.com/2010/11/finding-file-creation-time-in-linux.html
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 3.8G 2.2G 1.4G 62% /
/dev/sda3 4.6G 139M 4.3G 4% /home
/dev/sda1 46M 11M 33M 25% /boot
tmpfs 333M 0 333M 0% /dev/shm
root@Linux-Mach # cd /opt
root@Linux-Mach # touch sample_file
root@Linux-Mach # ls -l sample_file
-rw-r--r-- 1 root root 0 2012-04-24 18:35 sample_file # File-creation time is 18:35
root@Linux-Mach # date
Tue Apr 24 18:40:12 CDT 2012
root@Linux-Mach # cat > sample_file
This is test file to check creation time of this file.
Ctrl+D
root@Linux-Mach # ls -l sample_file
-rw-r--r-- 1 root root 29 2012-04-24 18:40 sample_file
root@Linux-Mach # ls -i sample_file
135528 sample_file # inode number
root@Linux-Mach # debugfs -R 'stat <135528>' /dev/sda2
Inode 14552801 Type regular Mode 0644 Flags 0x80000
Generation 340511001 Version 0x0000000000000001
User 1000 Group 1000 Size 29
File ACL 0 Directory ACL 0
Links 1 Blockcount 8
Fragment Address 0 Number 0 Size 0
ctime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
atime 0x3f1da5ec8725434 -- Tue Apr 24 18:40:54 2012
mtime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
crtime 0x3f1cacc966104fc -- Tue Apr 24 18:35:28 2012 # we could see file creation time
Size of extra inode fields 28
EXTENTS
(0) 44665199
debugfs 1.41.11 (14-Mar-2010)
http://ashok-linux-tips.blogspot.com/2010/11/finding-file-creation-time-in-linux.html
Now the good news is, with 'EXT4' file-system it is possible to get the File-creation time.
Here's the test results performed on a EXT4 file-system:
root@Linux-Mach # df -hFilesystem Size Used Avail Use% Mounted on
/dev/sda2 3.8G 2.2G 1.4G 62% /
/dev/sda3 4.6G 139M 4.3G 4% /home
/dev/sda1 46M 11M 33M 25% /boot
tmpfs 333M 0 333M 0% /dev/shm
root@Linux-Mach # cd /opt
root@Linux-Mach # touch sample_file
root@Linux-Mach # ls -l sample_file
-rw-r--r-- 1 root root 0 2012-04-24 18:35 sample_file # File-creation time is 18:35
root@Linux-Mach # date
Tue Apr 24 18:40:12 CDT 2012
root@Linux-Mach # cat > sample_file
This is test file to check creation time of this file.
Ctrl+D
root@Linux-Mach # ls -l sample_file
-rw-r--r-- 1 root root 29 2012-04-24 18:40 sample_file
root@Linux-Mach # ls -i sample_file
135528 sample_file # inode number
root@Linux-Mach # debugfs -R 'stat <135528>' /dev/sda2
Inode 14552801 Type regular Mode 0644 Flags 0x80000
Generation 340511001 Version 0x0000000000000001
User 1000 Group 1000 Size 29
File ACL 0 Directory ACL 0
Links 1 Blockcount 8
Fragment Address 0 Number 0 Size 0
ctime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
atime 0x3f1da5ec8725434 -- Tue Apr 24 18:40:54 2012
mtime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
crtime 0x3f1cacc966104fc -- Tue Apr 24 18:35:28 2012 # we could see file creation time
Size of extra inode fields 28
EXTENTS
(0) 44665199
debugfs 1.41.11 (14-Mar-2010)
root@Linux-Mach #
Please note the entry "crtime" which displays the file-creation time. In my view, this information would be of great help in certain situations.
Please note the entry "crtime" which displays the file-creation time. In my view, this information would be of great help in certain situations.
Pl clarify the below.
ReplyDeleteroot@mysql-1:/home/mysql1/Downloads# ls -l
total 4
-rw-r--r-- 1 root root 394 May 2 17:25 authorized_keys2
root@mysql-1:/home/mysql1/Downloads#
I can able to see the time (17:25) without your procedures shown. Is there any difference from your idea.
Karthikeyan - You need to use the "debugfs -R 'stat ' /dev/YOUR_HDD_PARTITION" to get this data as Ashok mentioned above.
Delete@Karthikeyan, 'ls -l' gives you only the Modified time of the file and NOT the file-creation time. You will not know when this file is actually created.
DeletePlease note that in Linux or any Unix flavors, there are 3 time stamps:
1. atime : The last time file was opened or executed
2. ctime : The time the inode information was updated (chmod, chown etc does that). ctime also gets updated when file is modified
3. mtime: The time file was closed after it was opened for write
Command to see atime # ls -lu
Command to see ctime # ls -lc
Command to see mtime # ls -l
So all the above given time stamps change per the usage and hence Linux does not have file creation time until EXT3. Only EXT4 got that feature.
You need to start using sudo my friend :)
ReplyDeleteThanks Ashok..., Got clarified.
ReplyDeleteWonderful Ashok Raj, Thanks for sharing this great information....:)
ReplyDeleteHi Ashok is this will work for LVM
ReplyDeleteHi Ashok , I had checked this and it will work in LVM too
ReplyDeletedebugfs -R 'stat <131080>' /dev/vg00/LogVol11
debugfs 1.41.12 (17-May-2010)
Inode: 131080 Type: regular Mode: 0644 Flags: 0x80000
Generation: 3453205173 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 180
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x529462e7:58b0c6f4 -- Tue Nov 26 03:59:19 2013
atime: 0x529d4ddf:3528ff98 -- Mon Dec 2 22:19:59 2013
mtime: 0x5294d2b7:2a7040e4 -- Tue Nov 26 11:56:23 2013
crtime: 0x529462e7:58b0c6f4 -- Tue Nov 26 03:59:19 2013
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:home_root_t:s0\000" (37)
EXTENTS:
(0): 557062
Nice post with nice tips dear. RDP Thin Client & Citrix Thin Client & Linux Thin Client
ReplyDelete