File Creation Time

devUnix · 03-10-2012, 07:35 PM

Hi!

Is there any way to identify or figure out the creation time of a file / directory? Per my research on the subject, I have found that Unix/Linux does not store the creation time of a file/directory anywhere on the system. However, the same can easily be obtained on a Windows System. It maintains Creation Time as well as other time-stamps such as Last Change and Last Access.

Could there just be a to do that on a Unix / Linux system?

unSpawn · 03-10-2012, 08:16 PM

Quote:

Originally Posted by devUnix

Unix/Linux does not store the creation time

That is correct and you answered your own question already: intercepting syscalls using LD_PRELOAD tricks, inotify or the audit service may yield some results but in UNIX it is not possible to retrieve creation time from the file system itself. (And best not compare Microsoft products with Linux.) If you're trying to solve a problem then here's your chance to elaborate.

devUnix · 03-10-2012, 08:34 PM

Quote:

Originally Posted by unSpawn

(And best not compare Microsoft products with Linux.) If you're trying to solve a problem then here's your chance to elaborate.

Well, not really meant to compare Windows OS with Unix or Linux. Just an example is given so that those who might not know, may know it too.

Reuti · 03-11-2012, 12:04 PM

In newer versions of stat there is already a field Birth: - and it should show the crtime of ext4 file systems AFAIK. But I never saw anything else displayed there besides a hyphen. Maybe some support is still missing in the kernel.

unSpawn · 03-11-2012, 03:34 PM

Quote:

Originally Posted by Reuti

In newer versions of stat there is already a field Birth: - and it should show the crtime of ext4 file systems AFAIK.

Awesome, thanks.
[0] http://computer-forensics.sans.org/b...t-2-timestamps
[1] http://snippets.dzone.com/posts/show/12121

devUnix · 03-12-2012, 05:18 AM

Quote:

Originally Posted by Reuti

In newer versions of stat there is already a field Birth: - and it should show the crtime of ext4 file systems AFAIK. But I never saw anything else displayed there besides a hyphen. Maybe some support is still missing in the kernel.

Excellent work!

So, at least EXT4 is what we need to figure out the Creation Time or Birth Date/Time of a file.

Thanks! Rated for your effort!