Find Out When A File Was Created

Today we’re going to have a very simple article because it’s not all that complicated to find out when a file was created. This is something you can do quickly and easily in the terminal and something everyone should be aware of because it involves a deeper subject. So, read on to learn how to find out when a file was created – and why you might want to care.

Files contain metadata, as a general rule. This data can include lots of information. For example, some word processing applications may store the author’s name as a part of the metadata. This can have privacy implications.

Pictures can contain a lot of metadata, including the subject’s location according to GPS. In the case of pictures, they not only store metadata, they store EXIF data. This article is about metadata but I wrote this article about cleaning a picture’s EXIF data for privacy’s sake.

How To: Sanitize Exif Data From Your Digital Images For Privacy Sake

If you’re regularly sharing files by email, you might also be interested in this article:

Review: MetaClean (Clean Exif/meta Data From Email Attachments Automatically)

What Is Metadata:

So, what is metadata? Metadata can contain things like when the file was created (the subject of this article). The metadata can also include things like when the file was last accessed as well as information about when the file was last modified. (How else do you think ‘sort by date’ works in your GUI file managers?)

I’m going to suggest reading this Wikipedia article about metadata:

Metadata on Wikipedia

As you can see, metadata can contain a whole lot of information. There are tools to modify the metadata, but this article is not going to touch on that. For the privacy-conscious, metadata might be important. For those who require anonymity, metadata might be really important.

Today, we’ll be looking at some of that metadata. In this case, the data we’ll be looking at is time-related. You’ll not just see when a file is created, you might also see when you last modified the file or even when you last accessed the file. For the unaware, this might seem a bit creepy. However, this metadata has good value for some folks.

The stat Command:

The tool we’ll be using is the stat command. You almost certainly have this command available to you, as it is a part of the core utilities. As such, you can expect the stat command to be available on any distro outside of the tiny distros and maybe embedded systems. The rest of the distros will likely have stat available.

If you want to verify that you have stat available, run this command:

stat --v

There’s quite a lot to the stat command. The stat command is described as:

stat – display file or file system status

You should check the man page if you want to come to grips with the command.

man stat

See? I wasn’t kidding about it being complicated! There’s a whole lot to the stat command for the uninitiated but we’ll keep it simple. After all, we just want to find out when a file was created. We don’t need much.

Find Out When A File Was Created:

This stat command is one of those commands that require the terminal. If you don’t know how to open the terminal (and you probably should by now), you can just press CTRL + ALT + T and your default terminal should open.

With your terminal now open, just run the command. The syntax is simple:

stat /path/to/file

For example, this is what I get for output from the sort.txt I’ve had you use in previous articles:

$ stat sort.txt
File: sort.txt
Size: 67 Blocks: 8 IO Block: 4096 regular file
Device: 802h/2050d Inode: 9322157 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 1000/ kgiii) Gid: ( 1000/ kgiii)
Access: 2023-10-20 18:21:37.307185160 -0400
Modify: 2023-10-02 19:21:47.679925512 -0400
Change: 2023-10-02 19:21:47.699925699 -0400
Birth: 2023-10-02 19:21:47.671925436 -0400

If it’s not obvious, the line we’re interested in, that is when the file was created, starts with ‘Birth:’ That’s when the file was created.

Now, if you downloaded the file and checked the metadata, some of that information will be different than what I had as output. Pretty neat, huh?

Anyhow, if you just want to show when a file was created, and nothing else, you can do that. That command is just:

sort -c %w /path/to/file

But, it’s easier than that. Rather than remember the flags, just remember that the line we’re after starts with ‘Birth:’ and use grep. To do that, your command would look like this:

sort /path/to/file | grep Birth:

Go ahead and try these commands with various files around your system. You’ll find out that there’s quite a bit of data being saved. Pictures don’t just contain EXIF data, they also contain metadata. If you’re truly concerned about privacy, you might want to find a way to munge this data – or simply stop sharing the file(s) you’re concerned about.

Closure:

Well, that’s about it for the stat command. You don’t need much, even though the application is truly complicated. If you want to find out when a file was created, you can do that. You can do that quite easily. All you need is the stat command. If you want to be specific or use the output as an input to another command, you can always use the various flags or even grep. See? It’s not so hard after all!

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.