JIYIK CN >

This article will explain how to get file creation date/time in Bash. We will start our discussion with a brief introduction to file creation in the old system.

Later we will learn about creating files in Bash. Finally, we will discuss different ways to get the creation date/time of a file in Bash.

Creating Files in Linux

There are multiple ways to create files in Linux. We can create files using shell or desktop file manager.

This article will focus on how to create files on Bash using shell commands.

Using the touch command

In Linux, the touch command can be used to create new files. The syntax of touch command is touch file name.

To create a file, name it ABC.XYZ; we have to write:

$ touch ABC.XYZ

This command will create an empty file named ABC.XYZ. We can run the ls command in the current directory to see the file if it has been created.

Using cat command

We can catcreate a new file with the help of command. We can combine redirection operation with passing user input into a new file.

catThe command will prompt the user to enter text. The user can press the return key to move to the next line.

To complete this command, press Ctrl+D; the entire text entered by the user will be saved line by line in the file. See example:

$ cat > my_file.txt
Welcome to Bash shell!
The text entered here will be written into a text file.
Ctrl+D

The last statement is not written but is the key combination pressed by the user to terminate the command. In response, the following two lines are written to a text file named my_file.txt.

Using the redirection operator

We can create a blank file using only the redirection operator. Entering the redirection operator followed by the file name will create a blank text file.

For example:

$ > my_file.txt

You can verify the file creation by using the ls command again. It is also possible that a file with the same name already exists, in our case my_file.txt.

In this case, the command will erase the previous contents of the file, and an empty file named my_file.txt will appear.

We should check and confirm that the previous content will be there or deleted. Use cat command to read the content of the file.

$ cat my_file.txt

If there are no errors, such as typos in the file name, directory, etc., then the file will be empty.

Using echo command

echoThe command takes a string as an argument and displays it as output. For example:

$ echo "This is the first file"
This is the first file

We can echowrite some content after the command and the redirection operator to create a new file with the passed content. Also in this case, if the file already exists, the command will delete the previous content.

See example:

$ echo "This is the First file" > firstFile.txt

The result of this echo command will create a new file where file will contain the text passed as an argument to echo. These are all the ways to create files in Bash.

Get File Creation Date/Time in Linux

After successfully creating the file, our next step is to find the date and time the file was created. Most older systems run older file system versions that require the file creation date to be stored.

Since the POSIX standard specifies only 3 different timestamp values ​​to be stored for each file, there is no requirement for the file system to support anything beyond them, ie no creation time is available.

These 3 timestamps store the following information:

1. Last access date - atime
2. Last modified date - mtime
3. Last modified date - ctime

The values stat​​are returned in a structure with the file characteristic named struct. The details are described on the website.

However, newer file systems (ext4, zfs, btrfs, JFS, and XFS) store the creation timestamp in a separate field:

1. ext4 – crtime
2. zfs – crtime
3. XFS – crtime
4. btrfs – otime
5. JFS - di_otime

The above fields store the data in the file inode. There are 3 different ways to get the file creation date/time in Bash.

The first one is very crude (non-technical) and works on older OS, while the next two are technical but available in advanced OS/newer versions.

Using the file name

As we have already discussed, the stat command displays 3 timestamps in older operating systems and there is no timestamp associated with the file creation. However, the user (file creator) can concatenate the creation time with the file name and this method will work if the file name is not modified.

For example:

touch data1_18_oct_2022_10_11_AM
touch data2_18_oct_2022_11_20_AM
...
ls -l

Output:

-rwxrwxrwx 1 root  root   0 Oct 18 05:16 data1_18_oct_2022_10_11_AM
-rw-r--r-- 1 14079 14079  0 Oct 18 05:16 data2_18_oct_2022_11_20_AM
...
-rwxrwxrwx 1 root  root  69 Oct 18 05:16 main.bash

In the output, the file creation date and time are visible along with the file name (usually, people have file names like data1, data2, etc.)

Using the stat Command

statcommand can directly get the file creation date/time. The old version provides us with 3 timestamp values.

These timestamp values ​​are the time when the file was last accessed, the time when the file data was last modified, and the time when the file status was last changed. But in newer OS versions, it also provides the birth/creation time of the file.

Let's check this out by creating a new file in Bash and getting the date/time.

touch f1
stat f1
touch f2
cat f2>f1
touch f1
stat f1

Output:

Access: 2022-10-17 15:24:16.676971765 +0000
Modify: 2022-10-17 15:24:16.676971765 +0000
Change: 2022-10-17 15:24:16.676971765 +0000
 Birth: 2022-10-17 15:24:16.676971765 +0000

Access: 2022-10-17 15:24:16.684972083 +0000
Modify: 2022-10-17 15:24:16.684972083 +0000
Change: 2022-10-17 15:24:16.684972083 +0000
 Birth: 2022-10-17 15:24:16.676971765 +0000

In the above code, first, we create the file f1 using the touch command and then check its creation date/time using the stat command. Then we create another file named f2.

Using catand >, we append the contents of f2 to the end of f1. We then make f1 again and check its creation date/time.

If we look at the output carefully, we can see that the access date/time of file f1 and the birth date/time of file f1 are the same, which means both the files were created at the same date/time.

Using debugfs command

debugfscommand is also available in ext4 file system; we can find the file creation date using this command. Please note that the main purpose of debugfs command is to debug the file system; however, we can also use this command to find the file creation date.

First, we need the inode number of the file, which we can view using the ls command. The -i flag causes ls to print the inode number of the file.

$ ls -i ./file
5118705 ./file

dfis the command we can use to open the file system.

~ $ df ./file
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda2             26046564   8380600  16338936  34% /

Next, we pass this information to the debugfs command, the syntax of which is debugfs -R'stat <inode>'/dev/sdXwhere inode is our file inode and /dev/sdX is the file system file.

$ sudo debugfs -R 'stat <5118705>' /dev/sda2
debugfs 1.46.4 (18-Aug-2021)
Inode: 5118705   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 2975709199    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 8
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x61bc31c8:19fee850 -- Fri Oct 14 06:44:24 2022
atime: 0x61bc3224:7f8fe250 -- Fri Oct 14 06:45:56 2022
mtime: 0x61bc31c8:19fee850 -- Fri Oct 14 06:44:24 2022
crtime: 0x61bc2b65:71f8e150 -- Fri Oct 14 06:17:09 2022
Size of extra inode fields: 32
Inode checksum: 0x5ddd5b4b
EXTENTS:
(0):5279293

The field visible above crtimehas the file creation time. The file creation time Fri Oct 14 06:17:09 2022 is the exact date when the file was created.

However, note that the fields ctimelook similar but are different. crtimeThe fields contain the time of the last state change of the file, such as a change in file permissions.

In this article, we describe 3 ways to get the date and time of file creation. This depends on whether the user is using an old or new operating system.

In case of older versions, we can use the first, non-technical way. Otherwise, the second and third methods are available, where the management is inside the operating system.

Users can obtain the creation date and time by running related commands.