Unix File Creation Time

Does not exist. Well, maybe it does; this really depends on the filesystem. Some filesystems support a file creation time, and others do not. But what about the "ctim" field as mentioned in stat(2)? Is that not short for "creation time"? Nope.

    $ df /tmp
    Filesystem  512-blocks      Used     Avail Capacity  Mounted on
    /dev/sd0d      8114908        64   7709100     1%    /tmp
    $ grep /tmp /etc/fstab
    38fcd6f796507fa1.d /tmp ffs rw,nodev,nosuid,noatime 1 2
    $ cd /tmp
    $ rm foo
    rm: foo: No such file or directory
    $ touch foo
    $ stat -t '%Y-%m-%d %H:%M:%S' -f %Sc foo
    2024-02-24 02:25:51
    $ sleep 60 ; chmod go-rwx foo ; stat -t '%Y-%m-%d %H:%M:%S' -f %Sc foo
    2024-02-24 02:26:57

So the "st_ctim" field holds the time of the last file status change, which does happen on file creation, but also happens when various other sorts of status changes occur, such as a chmod. Any file status change will destroy the previous record, so "st_ctim" may or may not reflect when the file was created.

    $ man 2 stat | grep time | sed 3q
         struct timespec st_atim;    /* time of last access */
         struct timespec st_mtim;    /* time of last data modification */
         struct timespec st_ctim;    /* time of last file status change */

To be fair, there are some file systems that support a "creation time" (some label it as "birth time") as distinct from the st_ctim "file status change", but you may not have one of those, and this field probably does not use the st_ctim field.

    $ man 1 stat | perl -00 -ne 'print if m/birth/'
       a, m, c, B
               The time file was last accessed or modified, or when the
               inode was last changed, or the birth time of the inode
               (st_atime, st_mtime, st_ctime, st_birthtime).  If the
               file system does not support birth time, the value is
               undefined.

P.S. If you are trying to fake timestamps it's probably best to change the system clock, especially if you are using some complicated Office Suite that may embed timestamps internally in the probably opaque and complicated file format. There is also a utimes(2) call, and doubtless various non-portable things depending on the specific operating system or filesystem involved.

-- Response ended

-- Page fetched on Tue May 21 11:52:24 2024