How to find the creation time of a file (again)...

[SeSe]

Hi,
Is there any way to find out the creation time of a file?
What I did:

First I ran the command on an old file

truss -vlstat -tlstat ls -l testfile
lstat64("testfile", 0xEFFFF380) = 0
d=0x0080000F i=194347 m=0100750 l=1 u=1004 g=1 sz=5018
at = Feb 28 10:21:01 GMT 2002 [ 1014891661 ]
mt = Nov 29 19:35:10 GMT 2001 [ 1007062510 ]
ct = Feb 1 18:11:18 GMT 2002 [ 1012587078 ]
bsz=8192 blks=10 fs=ufs
-rwxr-x--- 1 tpm other 5018 Nov 29 19:35 testfile

I edited the file then got:

# truss -vlstat -tlstat ls -l testfile
lstat64("testfile", 0xEFFFF380) = 0
d=0x0080000F i=194347 m=0100750 l=1 u=1004 g=1 sz=5019
at = Feb 28 11:07:23 GMT 2002 [ 1014894443 ]
mt = Feb 28 11:07:32 GMT 2002 [ 1014894452 ]
ct = Feb 28 11:07:32 GMT 2002 [ 1014894452 ]
bsz=8192 blks=10 fs=ufs
-rwxr-x--- 1 tpm other 5019 Feb 28 11:07 testfile

Edited the file again and got:

# truss -vlstat -tlstat ls -l testfile
lstat64("testfile", 0xEFFFF380) = 0
d=0x0080000F i=194347 m=0100750 l=1 u=1004 g=1 sz=5020
at = Feb 28 11:09:11 GMT 2002 [ 1014894551 ]
mt = Feb 28 11:09:20 GMT 2002 [ 1014894560 ]
ct = Feb 28 11:09:20 GMT 2002 [ 1014894560 ]
bsz=8192 blks=10 fs=ufs
-rwxr-x--- 1 tpm other 5020 Feb 28 11:09 testfile



I tried another command

(truss -t stat -v all file testfile 2>&3 >/dev/null) 3>&1 | tail -6
at = Feb 28 11:19:24 GMT 2002 [ 1014895164 ]
mt = Jul 16 05:20:28 BST 1997 [ 869026828 ]
ct = Aug 16 21:01:53 BST 2000 [ 966456113 ]
bsz=8192 blks=50 fs=ufs
stat("/usr/lib/locale/C/LC_MESSAGES/magic", 0xEFFFF3F8) Err#2 ENOENT
stat64("testfile", 0xEFFFF300) Err#2 ENOENT

Any suggestions? Carlos?

 

[cfsalmeida]

You probably don't see the other thread about this one ...,
you cannot obtain creation time (ctime), is NOT the files creation date, creation date is not recorded anywhere in the Unix file system, files have a last-modified time (shown by "ls -l&quot, a last-accessed time (shown by "ls -lu&quot and an inode change time (shown by "ls -lc&quot, the latter is often referred to as the "creation time", even in some man pages but that's wrong, it's also set by such operations as mv, ln,chmod, chown and chgrp.
"mtime" - time the contents of file was last modified (written to).
"atime" - time the file was last used/accessed (read or executed)
"ctime" - time the inode of the file was last changed (like changing permissions), ctime also gets updated every time mtime is modified, but not when the atime is changed, in the other thread I show the use of truss to get all three in the same command, sorry for the bad news ...

Kind Regards,

Carlos Almeida,

 

[bluedevils]

This is a stab in the dark, but wouldn't trip wire keep track of when new files are created?