Today's article has us finding out when a file was created...

KGIII

Super Moderator
Staff member
Gold Supporter
Joined
Jul 23, 2020
Messages
6,436
Reaction score
5,711
Credits
51,793
This can be handier than one might first think. It's also in the terminal, though there's likely a GUI way to do this in your file manager.


Feedback is awesome.
 


captain-sensible

Well-Known Member
Joined
Jun 14, 2019
Messages
2,855
Reaction score
1,931
Credits
17,653
I can think of one use, that is if a sound recoding would be permitted as evidence in Court and an allegation that a file has been tampered with. I guess if ls -l shows creation date at the time it was created that might be sufficient to show the file is original ?
 
OP
K

KGIII

Super Moderator
Staff member
Gold Supporter
Joined
Jul 23, 2020
Messages
6,436
Reaction score
5,711
Credits
51,793
I am sure it gets used for forensic purposes. Unless there's evidence of tampering, like the file modification date, it should be sufficient for evidentiary purposes.
 

osprey

Member
Joined
Apr 15, 2022
Messages
77
Reaction score
43
Credits
672
There is a difference between ls -al output and "Birth" of the file:
Code:
[[email protected] ~]$ ls -al ipaddrlog.txt
-rw-r--r-- 1 yips yips 462 Jun 18 20:28 ipaddrlog.txt
compared to:
Code:
[[email protected] ~]$ stat ipaddrlog.txt
  File: ipaddrlog.txt
  Size: 462             Blocks: 8          IO Block: 4096   regular file
Device: 814h/2068d      Inode: 14685763    Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/     yips)   Gid: ( 1000/     yips)
Access: 2022-07-14 13:30:56.906664959 +1000
Modify: 2022-06-18 20:28:39.466996107 +1000
Change: 2022-06-18 20:28:39.466996107 +1000
 Birth: 2021-09-15 09:51:30.696720519 +1000
 

captain-sensible

Well-Known Member
Joined
Jun 14, 2019
Messages
2,855
Reaction score
1,931
Credits
17,653
this is what i get with stat on vanilla Arch :

Code:
[[email protected]:~/Desktop][1]$ stat --printf='%T' myfile.txt             (07-25 08:50)
device  2052
inode   683065
mode    33188
nlink   1
uid     1000
gid     1000
rdev    0
size    6
atime   1658734760
mtime   1658734760
ctime   1658734760
blksize 4096
blocks  8
link
[[email protected]:~/Desktop]$         
[[email protected]:~/Desktop]$ which stat                                           (07-25 08:51)
stat: shell built-in command
[[email protected]:~/Desktop]$
 

osprey

Member
Joined
Apr 15, 2022
Messages
77
Reaction score
43
Credits
672
captain-sensible's code output included:
Code:
....
atime   1658734760
mtime   1658734760
ctime   1658734760
....
This output about "myfile.txt" appears to show that file access time, modification time and change-of-file-attributes time are all the same, which one would expect of a file written once and not subsequently altered. What would the result look like for a file that was written, modified at a later time, and perhaps underwent a change of attributes?
 

captain-sensible

Well-Known Member
Joined
Jun 14, 2019
Messages
2,855
Reaction score
1,931
Credits
17,653
strange one, file was on my Desktop , so i assumed didn't need sudo ..but ...
Code:
[[email protected]:~/Desktop]$ sudo stat --printf="%w" myfile.txt           (07-26 09:54)
[sudo] password for andrew:
2022-07-25 08:39:20.060910414 +0100%
 
$100 Digital Ocean Credit
Get a free VM to test out Linux!

Linux.org Hosting Donations
Consider making a donation

Members online


Latest posts

Top