File Creation time

[Vinit Adya]

Is is possible for find the time of file creation? The time displayed with ls is the time the last time the file was created.

[Andreas Voss]

Hi,

the answer is NO.
files have three times in the inode status:
time of last modification (opening for writing)
time of last access (opening for reading)
time of last status change (chmod, chown ...)

Regards

[Stefan Farrelly]

The only way I know of to find when a file was created is to switch on auditing - and check for events which create files.

[James R. Ferguson]

Hi:

Here's a piece of trivia someone may find interesting.

In my other life I'm a systems programmer / administrator for large Unisys (Burroughs) mainframes. The operating system is called "MCP/AS" -- Master Control Program / Advanced Systems.

In this enviroment, file "attributes" are part of the directory structure (loosely, inode). Separate entities exist for a file's creation date/time, the last modification (alteration) date/time, the last access date/time (read or execute), the last execution time (for executables), the last time ownership or permissions were changed, the last date/time the file was copied TO its current directory, and the last date/time the file was copied FROM its current directory.

Knowing how and when each of these attributes change can be used as a virtual audit trail.

Only the MCP has the ability to change these attributes. No 'touch' command exists for a user to alter any of these attributes.

It's a different paradigm for sure.

...JRF...