How to Find Linux File Creation Time using Debugfs?

Everything is treated as a file in Linux, and all the information about a file is stored in inodes, which includes the crucial metadata about a file such as creation time, last modification, etc. Every file in Linux is identified by its inode number.

In this article, we will be using debugf command to find Linux File Creation Time with the help of stat(utility to find file or file system status) command that is used to get  Last Modified Date of File in Linux. Both stat command and Debugfs command together will be used to find actual file creation time in Linux.

 Find Linux file creation Time using debugfs 

Step 1: To find the inode number of the file which we need to know for finding the file creation time and the date we have to use the following command :

$ stat <file name>

Alternatively, ls -i command can also be used that will only show the inode number and skip all the other information.

$ ls -i  <file name>

So now we have got the inode number that is “7342019 ” for the file “tithi.jpeg”, copy that to your clipboard because we are going to need this inode number in our further steps.

Step 2: Find out the root filesystem in which the file resides using the following command:

$ df -h

So here, system the root partition is /dev/sda1, that might be different on your system, so make sure to check it properly and note it down.

Step 3: Now lastly, use the debugfs command for finding the creation time of the file called “tithi.jpeg” by using the following command :-

sudo debugfs -R 'stat <inode number>' /dev/sda1 

In the above result you can see different prefix such as ctime, atime, mtime, crtime, each of these has its own meaning that is:

• ctime: file change time Displayed.
• atime: file access time Displayed.
• mtime: Shows file modification time.
• crtime: Shows file creation time. (This is what we needed)