File Creation Time
Hi!
Is there any way to identify or figure out the creation time of a file / directory? Per my research on the subject, I have found that Unix/Linux does not store the creation time of a file/directory anywhere on the system. However, the same can easily be obtained on a Windows System. It maintains Creation Time as well as other time-stamps such as Last Change and Last Access. Could there just be a to do that on a Unix / Linux system? |
Quote:
|
Quote:
|
In newer versions of stat there is already a field Birth: - and it should show the crtime of ext4 file systems AFAIK. But I never saw anything else displayed there besides a hyphen. Maybe some support is still missing in the kernel.
|
Quote:
[0] http://computer-forensics.sans.org/b...t-2-timestamps [1] http://snippets.dzone.com/posts/show/12121 |
Quote:
So, at least EXT4 is what we need to figure out the Creation Time or Birth Date/Time of a file. Thanks! Rated for your effort! |
All times are GMT -5. The time now is 08:39 PM. |