Creation date of a file

bob123 · External Since: Nov 04, 2010 Posts: 8

Hi,

how I can find the creation date of a file ?

Thanks in advance

The Natural Philosopher · External Since: Jul 06, 2009 Posts: 186

bob123 wrote:
> Hi,
>
> how I can find the creation date of a file ?
>
> Thanks in advance
the nearest you will get is the ctime field revealed by stat, I think.

Richard Kettlewell · External Since: Feb 19, 2005 Posts: 189

The Natural Philosopher writes:
> bob123 wrote:
>> Hi,
>>
>> how I can find the creation date of a file ?
>>
>> Thanks in advance
> the nearest you will get is the ctime field revealed by stat, I think.

....which is also updated by chmod, chown, rename, unlink, etc.

IOW you can't, on Linux.

--
http://www.greenend.org.uk/rjk/

The Natural Philosopher · External Since: Jul 06, 2009 Posts: 186

Richard Kettlewell wrote:
> The Natural Philosopher writes:
>> bob123 wrote:
>>> Hi,
>>>
>>> how I can find the creation date of a file ?
>>>
>>> Thanks in advance
>> the nearest you will get is the ctime field revealed by stat, I think.
>
> ...which is also updated by chmod, chown, rename, unlink, etc.
>
> IOW you can't, on Linux.
>
I had a nasty feeling that was in fact the case..

But for a normal file that doesn't get subjected to the above tortures,
ctime is as good as it gets, no?.

Doug Freyburger · External Since: Dec 06, 2010 Posts: 10

The Natural Philosopher wrote:
> Richard Kettlewell wrote:
>> The Natural Philosopher writes:
>>> bob123 wrote:
>
>>>> how I can find the creation date of a file ?
>
>>> the nearest you will get is the ctime field revealed by stat, I think.
>>
>> ...which is also updated by chmod, chown, rename, unlink, etc.
>
> I had a nasty feeling that was in fact the case..
>
> But for a normal file that doesn't get subjected to the above tortures,
> ctime is as good as it gets, no?.

Generally mtime beats ctime.

1) There are a lot of backup utilities (tar is the best known) that
just copy the file to backup media. That sets the atime. There are a
lot of backup utilities (cpio is the best known) that save the inode,
copy the file to backup media, then restore the inode. That preserves
the atime but it sets the ctime. Neither strategy effects the mtime.

2) When writing to a file sometimes the ctime is changed sometimes it is
not. If a file is extented at all, end of file marker in the inode is
"c"hanged, whether the list of blocks in the inode structure is changed
or not. This means it happens that ctime is older than mtime but it's
common for both to track. Add in backups and mtime tends to be older.

The UNIX inode structure does not include a create time the way ODS-2 on
VMS did. The best you can get is the oldest of mtime, ctime and atime.
If you have to pick only one, mtime beats ctime for the reasons above.

It's not hard to find all three and compare - Do that.

Richard Kettlewell · External Since: Feb 19, 2005 Posts: 189

Doug Freyburger writes:
> Generally mtime beats ctime.
>
> 1) There are a lot of backup utilities (tar is the best known) that
> just copy the file to backup media. That sets the atime. There are a
> lot of backup utilities (cpio is the best known) that save the inode,
> copy the file to backup media, then restore the inode. That preserves
> the atime but it sets the ctime. Neither strategy effects the mtime.
>
> 2) When writing to a file sometimes the ctime is changed sometimes it is
> not. If a file is extented at all, end of file marker in the inode is
> "c"hanged, whether the list of blocks in the inode structure is changed
> or not. This means it happens that ctime is older than mtime but it's
> common for both to track. Add in backups and mtime tends to be older.

All writes update ctime, at least in ext3. It's nothing to do with
whether the length changes.

See 'man fstat', do the experiment, or look at the kernel source.

--
http://www.greenend.org.uk/rjk/