Is there some special reason that Windows can tell you a file's creation time, but Linux generally does not?
Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
The truth is that NO system can tell you the birth time of a file, they can only report the data field as stored in the metadata for that file. The file metadata can be, and often is, wrong. We have tools to manipulate it if we want to MAKE it wrong. Why would you trust that?
As you can see, there is a Birth date given but it's a really silly one. Compare it with the Modify date, which looks appropriate to me.
It's not "really silly", it's potentially useful information.
It tells you the file arrived on your system a few months back, but the data within the file probably has not been modified for a decade.
Yes, both of those values can be spoofed, but have they been? If you haven't done it yourself, and your system hasn't been compromised, how likely is it...?
It's not "really silly", it's potentially useful information.
It tells you the file arrived on your system a few months back, but the data within the file probably has not been modified for a decade.
Would that be when I transferred my data from the old hard drive to the new one?
Would that be when I transferred my data from the old hard drive to the new one?
Possibly. Depending upon how you did it and what might have smudged the metadata for that file since then.
Personally, I keep a continuity document for each of my servers recording the hardware configuration, firmware level, significant changes and the dates of those changes, major software configurations and change dates. For a change I do a change document with reasons, expected benefits, expected behavior, test plan, and a backout plan in case things go south. (For trivial change this is a couple of paragraphs, for major changes 9rare, very rare) it can be 5 or 6 pages.
These are well practiced and less involved then the Official ones I learned to do for the companies I worked for. Those took approvals form another sysadmin, a supervisor, an operations of client supervisor, and were 5 to 12 pages EVERY DANG TIME! Yeah, I do not run anything that requires that much headache at home.
The thing is that the machine can be wrong, it can lie, but I have a journal where I can look it up if it really matters. That has literally saved lives (and my job) on occasion, and made recovery from failures of home hardware just frustrating instead of impossible.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.