How to get the time information whe a file or direcotry has been created.?

Latest response

Hi Techy Guys,

 

Is there any command to know the time information of a file / folder when it has been created first. I am not talking about access / modification time as we get these by

 

ls --time=ctime -ltrh tata
 

ls --time=atime -ltrh tata

 

I just want to know the time when it was created first time by the command touch / vi / vim.
 

Responses

Hi there,

 

I'm afraid that is not possible, since the information is not stored in the inode.

 

If you're interested in the information being kept in the inode, please have a look at

 

http://en.wikipedia.org/wiki/Inode

 

for more details.

 

As far as I know only the FreeBSD filesystem UFS2 supports creation time timestamps, and I'm not even 100% sure about that.

 

Cheers

 

Marko

Although creation time is not one of piece of information kept by the Linux Operating. You can use host based intrusion detection software such as tripwire and OSSEC (amogst others) to keep track of newly created files. You can also use the stat command to get information on files.

The stat command provides this information:

[root@shadowman ~]# stat /etc
File: `/etc'
Size: 12288 Blocks: 24 IO Block: 4096 directory
Device: fd00h/64768d Inode: 652802 Links: 122
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2011-10-07 05:02:38.830383956 -0700
Modify: 2011-10-07 03:13:24.963929426 -0700
Change: 2011-10-07 03:13:24.963929426 -0700

Some file systems support a "birth" time.  Unfortunately, just access, change (attributes) and modify are required.

 

If the file system supports a "birth" time, it may be printed with stat:

$ stat --format="%n %w" (path..)

 

In general, the "stat" command (and equivalent "stat" function calls in languages) will get you most meta-data on any file.

Thanks Phil for pointing out the duplicate of this thread. It has been removed.