Find the file creation time on Linux








  1. Locate the partition where the file exists, for example, the file you want to check is /home/wilson/123.txt, you can run the following command to find the partition:
    mount
    /dev/sda1 on / type ext4 (rw)
    /dev/sda5 on /home type ext4 (rw)
    
  2. Run the following command:
    sudo debugfs -R 'stat /home/wilson/123.txt' /dev/sda5
    
    Inode: 1842342   Type: regular    Mode:  0644   Flags: 0x80000
    Generation: 2327791571    Version: 0x00000000:00000001
    User:  6000   Group:  6000   Size: 0
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 0
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 0x50247e68:62eade1c -- Fri Aug 10 13:22:16 2012
     atime: 0x50247e68:62eade1c -- Fri Aug 10 13:22:16 2012
     mtime: 0x50247e68:62eade1c -- Fri Aug 10 13:22:16 2012
    crtime: 0x50247e68:62eade1c -- Fri Aug 10 13:22:16 2012
    Size of extra inode fields: 28
    EXTENTS:
    
    where crtime is the file creation time.



No comments:

Post a Comment