When is Birth Date for a file actually used?
Birth time is the time when the file was created on the filesystem, also known as the file creation time (crtime
on EXTFS). Note that, this is not defined by POSIX; only last access time (atime
), last modification time (mtime
) and the inode change time (ctime
) are mandated by POSIX.
IIRC, Linux yet does not provide any interface for getting the birth time, there is a proposal for xstat()
and fxstat()
, yet to be implemented.
As @muru noted, the newer approach is statx()
, which is merged in the mainline kernel recently. So, any (modified) userspace tool can leverage that (the statx
structure now, see below) on any such recent kernel.
struct statx {
__u32 stx_mask;
__u32 stx_blksize;
__u64 stx_attributes;
__u32 stx_nlink;
__u32 stx_uid;
__u32 stx_gid;
__u16 stx_mode;
__u16 __spare0[1];
__u64 stx_ino;
__u64 stx_size;
__u64 stx_blocks;
__u64 __spare1[1];
struct statx_timestamp stx_atime;
struct statx_timestamp stx_btime;
struct statx_timestamp stx_ctime;
struct statx_timestamp stx_mtime;
__u32 stx_rdev_major;
__u32 stx_rdev_minor;
__u32 stx_dev_major;
__u32 stx_dev_minor;
__u64 __spare2[14];
};
Here stx_btime
is the file creation time.
In the meantime, stat
is showing absence of the fields (or the empty values) st_birthtime
/st_birthtimesec
returned by the stat()
call, in the stat
structure:
struct stat {
dev_t st_dev; /* ID of device containing file */
ino_t st_ino; /* inode number */
mode_t st_mode; /* protection *
nlink_t st_nlink; /* number of hard links */
uid_t st_uid; /* user ID of owner */
gid_t st_gid; /* group ID of owner */
dev_t st_rdev; /* device ID (if special file) */
off_t st_size; /* total size, in bytes */
blksize_t st_blksize; /* blocksize for filesystem I/O */
blkcnt_t st_blocks; /* number of 512B blocks allocated */
time_t st_atime; /* time of last access */
time_t st_mtime; /* time of last modification */
time_t st_ctime; /* time of last status change */
};
There are some tricks with filesystem level debugging request to get the creation info from FS metadata e.g. for EXTFS:
debugfs -R 'stat /path/to/file' /dev/sda1
assuming the FS of the file in question is on partition /dev/sda1
. You can extract the value of crtime
to get the creation time of the file.
It should be the file creation time, but there is an outstanding issue, the gnu coreutils team waiting for xstat()
support in the kernel.
TODO: stat(1) and ls(1) support for birth time