How to get file creation date in Linux?

Question

I am working with batches of files that contain information about the same object at the different times of its life, and the only way to order them is by creation date. I was using this:

//char* buffer has the name of file
struct stat buf;
FILE *tf;
tf = fopen(buffer,"r");
//check handle
fstat(tf, &buf);
fclose(tf);
pMyObj->lastchanged=buf.st_mtime;

But that does not seems to work. What am I doing wrong? Are there other, more reliable/simple ways to get file creation date under Linux?

Answer 1

File creation time is not stored anywhere, you can only retrieve one of the following:

time_t    st_atime;   /* time of last access */
time_t    st_mtime;   /* time of last modification */
time_t    st_ctime;   /* time of last status change */

Your code should give you the last modification time, however. Note: you can use stat() instead of fstat() without opening the file (stat() takes the file name as param).

Answer 2

fstat works on file descriptors, not FILE structures. The simplest version:

#include <sys/types.h>
#include <sys/stat.h>
#include <stdio.h>

#ifdef HAVE_ST_BIRTHTIME
#define birthtime(x) x.st_birthtime
#else
#define birthtime(x) x.st_ctime
#endif

int main(int argc, char *argv[])
{
        struct stat st;
        size_t i;

        for( i=1; i<argc; i++ )
        {
                if( stat(argv[i], &st) != 0 )
                        perror(argv[i]);
                printf("%i\n", birthtime(st));
        }

        return 0;
}

You will need to figure out if your system has st_birthtime in its stat structure by inspecting sys/stat.h or using some kind of autoconf construct.

Answer 3

The nearest approximation to 'creation date' is the st_ctime member in the struct stat, but that actually records the last time the inode changed. If you create the file and never modify its size or permissions, that works as a creation time. Otherwise, there is no record of when the file was created, at least in standard Unix systems.

For your purposes, sort by st_mtime...or get the files named with a timestamp in the name.

---

Note that if you are on Darwin (Mac OS X), the creation time is available. From the man page for stat(2):

However, when the macro _DARWIN_FEATURE_64_BIT_INODE is defined, the stat structure will now be defined as:

 struct stat { /* when _DARWIN_FEATURE_64_BIT_INODE is defined */
     dev_t           st_dev;           /* ID of device containing file */
     mode_t          st_mode;          /* Mode of file (see below) */
     nlink_t         st_nlink;         /* Number of hard links */
     ino_t           st_ino;           /* File serial number */
     uid_t           st_uid;           /* User ID of the file */
     gid_t           st_gid;           /* Group ID of the file */
     dev_t           st_rdev;          /* Device ID */
     struct timespec st_atimespec;     /* time of last access */
     struct timespec st_mtimespec;     /* time of last data modification */
     struct timespec st_ctimespec;     /* time of last status change */
     struct timespec st_birthtimespec; /* time of file creation(birth) */
     off_t           st_size;          /* file size, in bytes */
     blkcnt_t        st_blocks;        /* blocks allocated for file */
     blksize_t       st_blksize;       /* optimal blocksize for I/O */
     uint32_t        st_flags;         /* user defined flags for file */
     uint32_t        st_gen;           /* file generation number */
     int32_t         st_lspare;        /* RESERVED: DO NOT USE! */
     int64_t         st_qspare[2];     /* RESERVED: DO NOT USE! */
 };

Note the st_birthtimespec field. Note, too, that all the times are in struct timespec values, so there is sub-second timing (tv_nsec gives nanosecond resolution). POSIX 2008 <sys/stat.h> requires the struct timespec time keeping on the standard times; Darwin follows that.

Answer 4

To get the file creation date in linux, I use the following method

root@sathishkumar# cat << _eof > test.txt 
> Hello
> This is my test file
> _eof
root@sathishkumar# cat test.txt 
Hello
This is my test file
root@sathishkumar# ls -i test.txt 
2097517 test.txt
root@sathishkumar# debugfs -R 'stat <2097517>' /dev/sda5

Inode: 2097517   Type: regular    Mode:  0664   Flags: 0x80000
Generation: 4245143992    Version: 0x00000000:00000001
User:  1000   Group:  1000   Size: 27
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x50ea6d84:4826cc94 -- Mon Jan  7 12:09:00 2013
 atime: 0x50ea6d8e:75ed8a04 -- Mon Jan  7 12:09:10 2013
 mtime: 0x50ea6d84:4826cc94 -- Mon Jan  7 12:09:00 2013
 crtime: 0x5056d493:bbabf49c -- Mon Sep 17 13:13:15 2012
Size of extra inode fields: 28
EXTENTS:
(0):8421789

atime: Last time file was opened or executed

ctime: Time the inode information was updated. ctime also gets updated when file is modified

mtime: Last modified time

crtime: File creation time