How to view the creation time of files in Linux

1. Introduction

Whether the creation time of a file in Linux can be found depends on the file system type. In early file systems before ext4 (ext, ext2, ext3), the file's metadata does not record the creation time of the file, it only records the access time, modification time, and change time (status change time). The basic information of a typical file is as follows:

[root@bugwz ~]# stat test.file
 File: 'test.file'
 Size: 2 Blocks: 8 IO Blocks: 4096 regular file
Device: 807h/2055d Inode: 5255117 Links: 1
Access: (0755/-rwxr-xr-x) Uid: (0/root) Gid: (0/root)
Access: 2019-12-12 19:11:33.175841399 +0800
Modify: 2019-12-12 19:11:37.564970487 +0800
Change: 2019-12-12 19:11:43.079132663 +0800
 Birth: -

Access: access time, the last access time of the file data (for example: reading the file content);
Modify: modification time, the last modification time of the file data. (For example: modify file contents);
Change: Status change time, which is easily confused with Modify time. It is the time when the file attributes (permissions, size, etc.) are changed;

2. Practice

2.1. Get the creation time of the file

Get the file inode number, as shown below, the inode number is: 5255117;

[root@bugwz data]# stat /data/test.file
 File: '/data/test.file'
 Size: 2 Blocks: 8 IO Blocks: 4096 regular file
Device: 807h/2055d Inode: 5255117 Links: 1
Access: (0755/-rwxr-xr-x) Uid: (0/root) Gid: (0/root)
Access: 2019-12-12 19:11:33.175841399 +0800
Modify: 2019-12-12 19:11:37.564970487 +0800
Change: 2019-12-12 19:11:43.079132663 +0800
 Birth: -

Find the disk path where the file is located, as shown below, the disk path is: /dev/sda7

[root@bugwz data]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 3.9G 2.5G 1.2G 70% /
devtmpfs 16G 0 16G 0% /dev
tmpfs 16G 0 16G 0% /dev/shm
tmpfs 16G 1.7G 14G 11% /run
tmpfs 16G 0 16G 0% /sys/fs/cgroup
/dev/sda1 12G 11G 787M 94% /usr
/dev/sda5 7.8G 4.2G 3.2G 57% /tmp
/dev/sda7 235G 180G 44G 81% /data
/dev/sda6 7.8G 2.1G 5.3G 29% /var

Use debugfs to view the creation time of the file and find that the creation time crtime is: Thu Dec 12 19:05:23 2019

[root@bugwz data1]# debugfs -R 'stat <5255117>' /dev/sda7
debugfs 1.42.9 (28-Dec-2013)
Inode: 5255117 Type: regular Mode: 0755 Flags: 0x80000
Generation: 758605841 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 2
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
 ctime: 0x5df2206f:12dddfdc -- Thu Dec 12 19:11:43 2019
 atime: 0x5df22065:29ec81dc -- Thu Dec 12 19:11:33 2019
 mtime: 0x5df22069:86b30fdc -- Thu Dec 12 19:11:37 2019
crtime: 0x5df21ef3:d586ca44 -- Thu Dec 12 19:05:23 2019
Size of extra inode fields: 28
EXTENTS:
(0):16949121

2.2. Integration script:

#!/bin/sh
[ $# -ne 1 ] && echo "Usage: $0 {FILENAME}" && exit 1

INODE=`ls -i $1 |awk '{print $1}'`
FILENAME=$1

# If the parameter contains /, get the directory path of the parameter and enter the directory `echo $FILENAME | grep / 1> /dev/null` && { FPWD=${FILENAME%/*};FPWD=${FPWD:=/};cd ${FPWD};FPWD=`pwd`; } || FPWD=`pwd`

array=(`echo ${FPWD} | sed 's@/@ @g'`)
array_length=${#array[@]}

for ((i=${array_length};i>=0;i--)); do
 unset array[$i]
 SUBPWD=`echo " "${array[@]} | sed 's@ @/@g'`
 DISK=`df -h |grep ${SUBPWD}$ |awk '{print $1}'`
 [[ -n $DISK ]] && break
done

# Exit if the file system is not ext4 [[ "`df -T | grep ${DISK} |awk '{print $2}'`" != "ext4" ]] && { echo ${DISK} is not mount on type ext4! Only ext4 file system support!;exit 2; }

debugfs -R "stat <${INODE}>" ${DISK}

Reference address: https://www.jb51.net/article/176316.htm

Summarize

The above is the full content of this article. I hope that the content of this article will have certain reference learning value for your study or work. Thank you for your support of 123WORDPRESS.COM.

You may also be interested in: