How to Get the File Creation Date/Time in Bash

1. File Creation in Linux
2. Get File Creation Date/Time in Linux

This tutorial will teach us how to get the file creation date/time in Bash. We’ll start our discussion by briefly introducing file creation in older systems.

Later we will learn file creation in Bash. Finally, we will discuss different methods for getting file creation date/time in Bash.

File Creation in Linux

There are various methods to create files in Linux. We can use the shell or the desktop file manager for file creation.

This article will focus on creating a file on Bash using shell commands.

Using the touch Command

In Linux, the touch command is available to create a new file. The syntax of the touch command is touch filename.

To create a file, name it ABC.XYZ; we have to write:

$ touch ABC.XYZ

This command will create an empty file named ABC.XYZ. We can run the ls command in the current directory to see the file (if created).

Using the cat Command

We can create a new file with the help of the cat command. We can combine redirection operations with taking input from the user into a new file.

The cat command will prompt the user to enter text. Users may enter the return key to move to the next line.

To finish this command, press Ctrl+D; the entire text input by the user will be saved in the file line by line. See example:

$ cat > my_file.txt
Welcome to Bash shell!
The text entered here will be written into a text file.
Ctrl+D

The last statement is not written but rather a key combination pressed by the user to terminate the command. In response, the following 2 lines will be written in the text file named my_file.txt.

Using the Redirection Operator

We can create a blank file using only the redirection operator. Entering the redirection operator followed by the file name will create a blank text file.

For example:

$ > my_file.txt

You can again use the ls command to verify the file creation. It is also possible that a file with the same name, in our case, my_file.txt, already exists.

In this case, the command will erase the previous contents of the file, and an empty file will be there with the name my_file.txt.

We should check and confirm that previous contents will be there or removed. Use the cat command to read the contents of the file.

$ cat my_file.txt

If nothing is wrong, like the spelling of the file name, directory, etc., then the file will be empty.

Using the echo Command

The echo command takes a string as an argument and displays it as output. For example:

$ echo "This is the first file"
This is the first file

We can write some contents after the echo command and the redirection operator to create a new file with the passed contents. Again, in this case, the command will remove the previous contents if the file already exists.

See example:

$ echo "This is the First file" > firstFile.txt

The result of this echo command will create a new file, where a file will contain the text passed as the argument to echo. These are all the methods to create files in Bash.

To read the details, click on this website.

Get File Creation Date/Time in Linux

After successfully creating the file, our next step is to find the date and time of file creation. Most older systems run old file system versions, which need to store the file creation date.

As the POSIX standards have only specified 3 distinct timestamp values stored for each file, there is no more requirement for a file system to support anything beyond them, i.e., no creation time available.

These 3 timestamps store information about:

1. Last access date - atime
2. Last modified date - mtime
3. Last change date - ctime

These values are returned in the structure having file characteristics named struct stat. The related details are described on the website.

However, newer file systems (ext4, zfs, btrfs, JFS, and XFS) store the creation time stamp in separate fields:

1. ext4 – crtime
2. zfs – crtime
3. XFS – crtime
4. btrfs – otime
5. JFS - di_otime

The above fields store data in the file inode. There are 3 different ways to get file creation date/time in Bash.

The first is very crude (non-technical) and can work with old operating systems, whereas the next 2 are technical but available in advanced operating systems/in newer versions only.

Use the File Name

As we have already discussed, the stat command shows 3-time stamps in older operating systems, and there is no time stamp related to file creation. However, the user (file creator) can concatenate creation time with the file name, which will be valid if the file name is not modified.

For example:

touch data1_18_oct_2022_10_11_AM
touch data2_18_oct_2022_11_20_AM
...
ls -l

Output:

-rwxrwxrwx 1 root  root   0 Oct 18 05:16 data1_18_oct_2022_10_11_AM
-rw-r--r-- 1 14079 14079  0 Oct 18 05:16 data2_18_oct_2022_11_20_AM
...
-rwxrwxrwx 1 root  root  69 Oct 18 05:16 main.bash

In the output, the file creation date and time are visible with the file name (usually, people have file names like data1, data2, etc.)

Use the stat Command

The stat command is straightforward to get the file creation date/time. The older version provides us with 3-time stamp values.

These timestamp values are the time the file is accessed latest, the last time the file data is modified, and the time the file status last changed. But in new operating system versions, it also provides the birth/creation time of the file.

Let’s check it by creating a new file in Bash and getting the date/time.

touch f1
stat f1
touch f2
cat f2>f1
touch f1
stat f1

Output:

Access: 2022-10-17 15:24:16.676971765 +0000
Modify: 2022-10-17 15:24:16.676971765 +0000
Change: 2022-10-17 15:24:16.676971765 +0000
 Birth: 2022-10-17 15:24:16.676971765 +0000

Access: 2022-10-17 15:24:16.684972083 +0000
Modify: 2022-10-17 15:24:16.684972083 +0000
Change: 2022-10-17 15:24:16.684972083 +0000
 Birth: 2022-10-17 15:24:16.676971765 +0000

In the above code, first, we create file f1 using the touch command, then check its creation date/time using the stat command. Then we create another file called f2.

Using cat and >, we append the contents of f2 at the end of f1. Then we are again making f1 and checking its creation date/time.

If we look closely at the output, we’ll know that our Access date/time of file f1 and birth date/time of file f1 are the same, meaning both files are created on the same date/time.

Note: We have run the script on jdoodle.com and replit.com, as they both support new OS versions. You can also check the scripts on these online compilers.

Use the debugfs Command

The debugfs command is also available in the ext4 file system; we can find the date of file creation using this command. Please note that the primary purpose of the debugfs command is to debug file systems; however, we can also find file creation dates using this command.

Firstly, we need our file’s inode number, which we can see with the ls command. The -i flag makes ls print the node numbers of files.

$ ls -i ./file
5118705 ./file

The df is the command we can use to open the file systems.

~ $ df ./file
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda2             26046564   8380600  16338936  34% /

Next, we’ll pass this information to the debugfs command, and the syntax of it is debugfs -R' stat <inode>'/dev/sdX where inode is our file inode, and /dev/sdX is the file system of the file.

$ sudo debugfs -R 'stat <5118705>' /dev/sda2
debugfs 1.46.4 (18-Aug-2021)
Inode: 5118705   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 2975709199    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 8
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x61bc31c8:19fee850 -- Fri Oct 14 06:44:24 2022
atime: 0x61bc3224:7f8fe250 -- Fri Oct 14 06:45:56 2022
mtime: 0x61bc31c8:19fee850 -- Fri Oct 14 06:44:24 2022
crtime: 0x61bc2b65:71f8e150 -- Fri Oct 14 06:17:09 2022
Size of extra inode fields: 32
Inode checksum: 0x5ddd5b4b
EXTENTS:
(0):5279293

The crtime field visible above has the file creation time. The file creation time, Fri Oct 14 06:17:09 2022, is the exact date when the file is created.

However, note that the field ctime seems similar but different. The time contains by the field crtime is the last status change of the file, like a change in the rights of a file.

In this article, we have described 3 ways to get file creation date & time. It depends on whether the user has an older or newer operating system.

In the case of the older version, we can adopt the first, non-technical way. Otherwise, the second & third method is available, where management is inside the operating system.

Users can get the creation date & time by running relevant commands.