DEBUGFS Command – Show File Creation Times in Linux

In Unix-like systems such as Linux, everything is considered a file, and all information about a file (metadata or file attributes such as creation time, last modification etc..), except the actual file content are stored in an inode and Linux identifies each and every file by its inode number other than the human readable filename.

In addition, the Linux stat program is a useful utility for displaying file or file system status. It shows information such as inode number, time of file birth, last data modification, last access, last status change and much more. We will combine both programs to find actual file creation time in Linux.

In this article, we will explain how to find one of the critical attributes of a file using the debugfs and stat programs to obtain the following creation/access information for a file in Linux filesystems.

  • ctime: Shows file change time.
  • atime: Shows file access time.
  • mtime: Shows file modification time.
  • crtime: Shows file creation time.

Find File Creation Date in Linux

1. To find a file creation date and time “crtime” is to find the inode of the file using the stat command against a file called “About-TecMint”.

$ stat About-TecMint 

  File: 'About-TecMint'
  Size: 260       	Blocks: 8          IO Block: 4096   regular file
Device: 80ah/2058d	Inode: 14420015    Links: 1
Access: (0777/-rwxrwxrwx)  Uid: ( 1000/ tecmint)   Gid: ( 1000/ tecmint)
Access: 2017-02-23 14:15:20.263337740 +0530
Modify: 2015-10-22 15:08:25.236299000 +0530
Change: 2016-08-01 10:26:36.603280013 +0530
 Birth: -

Alternatively, you can use the ls -i command against a file called “About-TecMint”.

$ ls -i About-TecMint
 
14420015 About-TecMint

From the output of the above commands, the file inode number is 14420015. Please make a note of this unique inode number as we will be using this inode number in the following steps.

2. Now we need to find the root filesystem that our file resides in, simply issue the following df -h command to identify the root file system.

$ df -h

Filesystem      Size  Used Avail Use% Mounted on
udev            3.9G     0  3.9G   0% /dev
tmpfs           788M  9.7M  779M   2% /run
/dev/sda10      324G  277G   31G  91% /
tmpfs           3.9G  192M  3.7G   5% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           3.9G     0  3.9G   0% /sys/fs/cgroup
/dev/loop3       87M   87M     0 100% /snap/core/4486
/dev/loop0       87M   87M     0 100% /snap/core/4407
/dev/loop1       82M   82M     0 100% /snap/core/4206
/dev/loop2      181M  181M     0 100% /snap/vlc/190
/dev/loop4      189M  189M     0 100% /snap/vlc/158
cgmfs           100K     0  100K   0% /run/cgmanager/fs
tmpfs           788M   40K  788M   1% /run/user/1000

From the above output, the filesystem for the root partition is /dev/sda10 (make a note of this filesystem). This will be different on your system.

3. Next, use the debugfs command to find the creation time of the file called “About-TecMint”, with the -R flag which instructs debugfs to execute the single external command specified with inode number 14420015 (stat in this case) and then exit.

$ sudo debugfs -R 'stat <14420015>' /dev/sda10

Inode: 14420015   Type: regular    Mode:  0777   Flags: 0x80000
Generation: 2130000141    Version: 0x00000000:00000001
User:  1000   Group:  1000   Size: 260
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x579ed684:8fd54a34 -- Mon Aug  1 10:26:36 2016
 atime: 0x58aea120:3ec8dc30 -- Thu Feb 23 14:15:20 2017
 mtime: 0x5628ae91:38568be0 -- Thu Oct 22 15:08:25 2015
crtime: 0x579ed684:8fd54a34 -- Mon Aug  1 10:26:36 2016
Size of extra inode fields: 32
EXTENTS:
(0):57750808
(END)

From the above output it clears that the file “About-TecMint” was created on Mon Aug 1 10:26:36 2016 as provided by crtime. You will also see “ctime“, “atime” and “mtime” of your file.

Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Aaron Kili

Aaron Kili is a Linux and F.O.S.S enthusiast, an upcoming Linux SysAdmin, web developer, and currently a content creator for TecMint who loves working with computers and strongly believes in sharing knowledge.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

8 Responses

  1. Lorell Hathcock says:

    Does this work on files that were created on a different server but have been copied to the server where I can issue the above commands on CLI?

  2. pezcurrel says:

    As of (at least) e2fsprogs version 1.44.1 there’s no need to find out the inode number in advance, you can pass the file path itself omitting the “”, like this…

    $ sudo debugfs -R 'stat /path/to/file' /dev/sdxX
    
  3. Ievgen Sobko says:

    How can modification date proceed creation date.

    mtime: 0x5628ae91:38568be0 -- Thu Oct 22 15:08:25 2015
    crtime: 0x579ed684:8fd54a34 -- Mon Aug  1 10:26:36 2016
    

    Or am I missing something?

  4. Peter Leung says:

    Did not work for me:

    $ sudo debugfs -R 'stat 14156716' /dev/sda1
    debugfs 1.43.4 (31-Jan-2017)
    14156716: File not found by ext2_lookup
    

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.