Working with File Creation Date in Linux: What You Need to Know

Unlike Windows, Linux doesn’t always store the file creation date as part of its default filesystem metadata—especially on older or traditional filesystems like ext3. However, newer filesystems and kernel versions offer partial support.

✅ What You Should Know:

1. Standard Timestamps in Linux:

   • atime: Last access time

   • mtime: Last modification time

   • ctime: Last status change time (not creation)

2. Creation Time (btime) Support:

   • Available on ext4, Btrfs, XFS, and ZFS (with caveats)

   • Requires Linux kernel 4.11+ for ext4 support

How to Check File Creation Date

🧪 1. Using stat (on supporting filesystems)

Look for Birth: or btime field (if supported).

🧪 2. Using debugfs (for ext4)

Then inside debugfs:

You may see

or similar field.

3. Using ls -lt –time=birth (if supported)

Note: May not work on all distros or filesystems.

Alternative Workarounds

• Use auditd to log creation events in real-time

• Track file creation manually via scripts or version control

• Use filesystem-specific tools (like xfs_io for XFS)

Tip for Developers

If you’re scripting or programming in Linux and need creation times reliably:

• Store creation timestamps manually in file metadata xattr or logs

• Or use a database/filesystem that logs this natively