Here's a shell script that determines the inode associated with a filename and then augments the stat output with the creation time by using stap ('systemtap'). It's clear that the inodes on my ext4 partitions have the creation time. You can extract the ext4 creation times on Fedora 19 systems.

Demo of ext4 creation time extraction below. TLDR Use stap ( 'SystemTap') to create your own kernel API. This is why stat -c '%w' file outputs - (indicating an unknown creation time) on Linux prior to coreutils 8.31 even for filesystems which do store the creation time internally.Īs Stephane Chazelas points out, some filesystems, such as ntfs-3g, expose the file creation times via extended file attributes.

While for instance BSD systems (and in extension OS X) provide st_birthtime via stat, Linux does not. Prior to coreutils version 8.31 stat accessed the birth time via the get_stat_birthtime() provided by gnulib (in lib/stat-time.h), which gets the birth time from the st_birthtime and st_birthtimensec fields of the stat structure returned by the stat() system call. However, coreutils stat uses the statx() system call where available to retrieve the birth time only since version 8.31. (So even when creation time support has been added to a filesystem, some deployed kernels have not immediately supported it, even after adding nominal support for that filesystem version, e.g., XFS v5.)Īs Craig Sanders and Mohsen Pahlevanzadeh pointed out, stat does support the %w and %W format specifiers for displaying the file birth time (in human readable format and in seconds since Epoch respectively) prior to coreutils version 8.31. Linux provides the statx(2) system call interface for retrieving the file birth time for filesystems that support it since kernel version 4.11. Modern Linux filesystems, such as ext4, Btrfs, XFS ( v5 and later) and JFS, do store the file creation time (aka birth time), but use different names for the field in question ( crtime in ext4/XFS, otime in Btrfs and JFS). The POSIX standard only defines three distinct timestamps to be stored for each file: the time of last data access, the time of last data modification, and the time the file status last changed. Note that on Linux this requires coreutils 8.31, glibc 2.28 and kernel version 4.11 or newer. Stat -c '%w' file on filesystems that store creation time.

Search mac for files by date