How to get the original create timestamp?

UNIX for Advanced & Expert Users
1

How do i get the original create timestamp in Unix?

I tried "ctime" but this gives me the change timestamp which changes with changes to inode (owner, permissions, etc.).

I need the timestamp when the file was originally created.

Thanks in advance!

2

I believe there is no embedded way of knowing the original timestamp. The ext2/ext3 inode structure looks like this:

struct ext2_inode {
        __u16   i_mode;         /* File mode */
        __u16   i_uid;          /* Low 16 bits of Owner Uid */
        __u32   i_size;         /* Size in bytes */
        __u32   i_atime;        /* Access time */
        __u32   i_ctime;        /* Inode change time */
        __u32   i_mtime;        /* Modification time */
        __u32   i_dtime;        /* Deletion Time */
        __u16   i_gid;          /* Low 16 bits of Group Id */
        __u16   i_links_count;  /* Links count */
        __u32   i_blocks;       /* Blocks count */
        __u32   i_flags;        /* File flags */
(...)

No reference to what you wish.

3

created timestamp for a file is not stored anywhere ( in the inode ) you could retrieve only modified time stamp, last accessed timestamp

4

The answer depends on your filesystem. Older filesystems UFS, ext2, etc do not store this information. Most of the newer filesystems do keep this information somewhere within their metadata, e.g. ext4 in crtime (creation timestamp), UFS2 in di_birthdate.