Here, the creation time is in the crtime field mentioned earlier. The syntax is debugfs -R ‘stat ’ /dev/sdX where inode is our file inode, and /dev/sdX is the filesystem of the file: $ sudo debugfs -R 'stat ' /dev/sda2 Now, we can pass this information to the debugfs command. For this, we can use the –format flag with %w as its value:įilesystem 1K-blocks Used Available Use% Mounted on We can also instruct stat only to give us the required data, which is the file creation date in our case. Size: 15 Blocks: 8 IO Block: 4096 regular file Now, let’s modify the file and check that only the “Modify” field changes, as it indicates the last modification time: $ echo 'Modified' > file Size: 6 Blocks: 8 IO Block: 4096 regular fileĪccess: (0644/-rw-r-r-) Uid: ( 1000/baeldung) Gid: ( 1000/baeldung)Īs we can see, the creation date is shown in the “Birth” field. Let’s create a file and check its creation time: $ date echo 'Hello' > file

The easiest way to get the file creation date is with the stat command.

How to find files by date on mac