Is there some special reason that Windows can tell you a file's creation time, but Linux generally does not?
I just learned about the
Code:
stat |
Historically UNIX hasn't stored the birth information.
I guess the guys who designed the UNIX filesystem were happy enough with just having Modification time and saw no use for birth time. Keep in mind that back then disks weren't very big and an extra (arguably useless) timestamp field for every file would be considered wasteful. BTW, birthtime isn't always empty on linux. Depends on the filesystem type. |
Quote:
|
And, just so you are aware, while Linux does not report that time Windows will. But it often lies!
Unix style file systems have interesting time stamps, that reflect the philosophy and expected use of the file system. The time it was created is not interesting to Unix/Linux systems, but the last time it was MODIFIED matters! For some things, the last time it was ACCESSED used to matter, but very little uses that these days. At core: Windows is not Linux, and Linux is not Windows, and no one should expect them to act the same way. EVER! |
not to speak about a lot of "questions", like what would be the creation time when you move/copy a file to another location? Should it keep the old value, or should it be the current time (since a new file was created). When you edit a file usually the old version is removed and a new file is created. Should it keep that creation time (time of birth)? What would be the creation time when you restore something from backup (on a different host/disk)? Or what should be used when you install (download) a package? Keep the time when the package was created?
For example git does not care about it at all. |
You can use 'stat' to get a files inode number and then 'debugfs' to get atime, ctime, mtime and crtime (creation time.) A search for stat and debugfs should turn up some methods for you. There will be cautions against 'borking' your system.
|
Quote:
|
Quote:
|
Quote:
Yes, there are plenty of underlying differences - and historic rationales for those differences - but there are also numerous examples where one has copied a feature from the other (and vice versa), or both have copied from somewhere else, because that particular feature is useful for users. The usefulness of features can sometimes only takes a short while to realise, whilst other times it can takes decades. There will also probably always be some underlying differences, because people have different needs. Understanding why there are differences can be useful and interesting. Telling people to "just accept it" is not. Quote:
You might also find the links at the bottom interesting. |
“And then, what happens next?” “Network file systems!” Every one of them more-or-less different. So it goes …
|
I'm confused. XFS, EXT4 and even VFAT appear to show Birth time.
Code:
stat maps.txt VMS versioning can be a bother but has come in handy once in awhile. Code:
$ dump /HEADER TEST.MEM |
It depends on two things i.e. the kernel version i.e. 4.11+ and the version of the utilities i.e stat itself.
|
Some filesystems record this information. Others do not. "There are no promises."
|
Quote:
I recommend they EXPECT it, which is a different thing. I also encourage people to ADD capabilities or features to Linux if they have the ability and really want that. We cannot do that to Windows (or other closed-source software) but we absolutely CAN do that with Linux! |
Both zfs and tmpfs give me a birth time for files on my system. However, if I stat the same files over sshfs, the birth field is empty.
|
Not seeing birth date over sshfs is because sftp does not have the capability. sshfs is technically not a filesystem.
|
Short answer is that only some Linux filesystems even have that field AND only some tools(!) have been amended to read/write it - or not ...
;) A classic real world example of the acronym YMMV :) |
I just ran stat on a file and got this weird result:
Code:
$ stat images/buttonbar.gif |
there was a link in post #9. It is practically useless, not in use, not supported everywhere and also in most cases meaningless.
|
The truth is that NO system can tell you the birth time of a file, they can only report the data field as stored in the metadata for that file. The file metadata can be, and often is, wrong. We have tools to manipulate it if we want to MAKE it wrong. Why would you trust that?
|
Quote:
It tells you the file arrived on your system a few months back, but the data within the file probably has not been modified for a decade. Yes, both of those values can be spoofed, but have they been? If you haven't done it yourself, and your system hasn't been compromised, how likely is it...? |
Quote:
|
Quote:
|
Quote:
Personally, I keep a continuity document for each of my servers recording the hardware configuration, firmware level, significant changes and the dates of those changes, major software configurations and change dates. For a change I do a change document with reasons, expected benefits, expected behavior, test plan, and a backout plan in case things go south. (For trivial change this is a couple of paragraphs, for major changes 9rare, very rare) it can be 5 or 6 pages. These are well practiced and less involved then the Official ones I learned to do for the companies I worked for. Those took approvals form another sysadmin, a supervisor, an operations of client supervisor, and were 5 to 12 pages EVERY DANG TIME! Yeah, I do not run anything that requires that much headache at home. The thing is that the machine can be wrong, it can lie, but I have a journal where I can look it up if it really matters. That has literally saved lives (and my job) on occasion, and made recovery from failures of home hardware just frustrating instead of impossible. |
All times are GMT -5. The time now is 04:10 PM. |