268

Possible Duplicate:
How do I do a ls and then sort the results by date created?

Is there a command in Linux which displays when the file was created ? I see that ls -l gives the last modified time, but can I get the created time/date?

Community
  • 1
  • 6
    Even while "OT" as this is asking for a tool to display this information, I think it's a valuable thing for programmers to know when dealing with more UNIX-y filesystems. –  Nov 11 '11 at 23:20
  • 4
    The command is `sudo debugfs -R 'stat /path/to/file' /dev/sdaX` (replace `sdaX` with the device name of the filesystem on which the file resides). The creation time is the value of `crtime`. You can add `| grep .[^ca]time` to list just `mtime` (the modification time) and `crtime` (the creation time). – The Quark Jun 04 '19 at 11:54
  • Some of the answers here are nearly 11 years old, and are no longer correct. [This top-voted answer](https://unix.stackexchange.com/a/24444/286615) is recently edited/updated, and worth a look. Also - if you're interested in **sorting your `ls` output** the `Possible Duplicate` also has an [up-to-date answer](https://unix.stackexchange.com/a/67895/286615) that reflects our current systems' status. – Seamus Jul 15 '22 at 23:53

3 Answers3

220

The stat command may output this - (dash). I guess it depends on the filesystem you are using. stat calls it the "Birth time". On my ext4 fs it is empty, though.

%w Time of file birth, human-readable; - if unknown

%W Time of file birth, seconds since Epoch; 0 if unknown

stat foo.txt
  File: `foo.txt'
  Size: 239             Blocks: 8          IO Block: 4096   regular file
Device: 900h/2304d      Inode: 121037111   Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/  adrian)   Gid: (  100/   users)
Access: 2011-10-26 13:57:15.000000000 -0600
Modify: 2011-10-26 13:57:15.000000000 -0600
Change: 2011-10-26 13:57:15.000000000 -0600
 Birth: -
Adrian Cornish
  • 2,664
  • 1
  • 13
  • 12
  • 2
    What if we do not have the `stat` command installed and I cannot add the `stat` command to this environment? `bash: stat: command not found` – javaPlease42 May 20 '14 at 16:19
  • 33
    While you mention %w you don't say how to use it. I'd suggest modifying this answer to show an example command to get the creation date if it's not included by default. For example "stat -c %w file" – dsollen Jul 25 '17 at 15:43
  • 1
    I'm sorry but is simply not the right answer. I'm looking at a file that I created days ago and it's showing me the birth time was some hours ago. – Wilmer E. Henao Jul 24 '19 at 14:53
  • 3
    Google [tells me](https://www.howtogeek.com/517098/linux-file-timestamps-explained-atime-mtime-and-ctime/) "*The standard ext4 Linux file system also allocates space for a file-creation timestamp in its internal file system structures, but this hasn’t been implemented yet. Sometimes, this timestamp is populated, but you can’t depend on the values in it.*" – Tgr Jun 15 '20 at 13:47
  • 3
    I feel like windows has the strongest point in this case. – MaXi32 Jul 17 '21 at 07:08
84

Linux offers three timestamps for files: time of last access of contents (atime), time of last modification of contents (mtime), and time of last modification of the inode (metadata, ctime). So, no, you cannot. The directory's mtime corresponds to the last file creation or deletion that happened, though.

thiton
  • 2,262
  • 14
  • 9
  • 43
    The file creation time is actually stored in Ext4, but not directly accessible. See http://unix.stackexchange.com/a/50184/8250 – Lekensteyn Feb 16 '13 at 10:02
  • 14
    There's a natural confusion between Linux OS, and the various filesystems that can be used with Linux. You can't just make general statements about Linux in regard to things specific to the filesystems. – LarsH Dec 18 '15 at 15:57
  • would it be correct to say that `mtime` >= creation time? – CervEd Apr 17 '21 at 20:03
  • 1
    @yzorg I think I understand your point but I'm not sure how volumes matter. Any copy of a file, even with `cp -a` will create a new inode, which will have its `ctime` the time the inode is created, but the same `mtime` (which was in the past). – CervEd Nov 27 '21 at 11:30
  • @yzorg I didn't say that. I said that if you `cp -a` it creates a new inode, which will have `mtime < ctime`. Volumes have nothing to do with it – CervEd Nov 30 '21 at 16:50
  • @CervEd apologies, I must have misunderstood, will delete my reply – yzorg Dec 01 '21 at 17:55
  • Out-of-date answer; unless you're working on vintage systems, this answer may be safely ignored. – Seamus Jul 15 '22 at 23:44
16

No, there is no such a command. In Unix creation time is not stored (only: access, modification and change).

  • 16
    Not true in general. Some common filesystems used in Linux don't store creation time, but others do: see http://unix.stackexchange.com/questions/7562/what-file-systems-on-linux-store-the-creation-time – LarsH Dec 18 '15 at 16:12
  • 3
    Some files may have metadata (such as exif) which record the creation date/time. If all of your files happen to be digital photos, you most likely have this data. Here is an [example using perl's Image::ExifTool](https://github.com/jonathancross/j-renamer/blob/master/j-renamer.pl#L322). – Jonathan Cross Jan 24 '17 at 20:45
  • 3
    It depends mainly on the filesystem, for example the `ext4` filesystem is storing the file creation date. – David Ferenczy Rogožan Oct 29 '19 at 15:28
  • Out-of-date answer; unless you're working on vintage systems, this answer may be safely ignored. – Seamus Jul 15 '22 at 23:43