tl;dr: since coreutils stat does not show file ‘birth’ time, use debugfs -R stat <inode> FS
I was curious as to when I wrote a particular time-saving script, so I figured I would look up the file creation time:
$ stat ~/scripts/goprofootage.sh File: /home/robert/scripts/goprofootage.sh Size: 1001 Blocks: 8 IO Block: 4096 regular file Device: fe01h/65025d Inode: 792618 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 1000/ robert) Gid: ( 1000/ robert) Access: 2018-01-07 08:23:04.816666962 +0000 Modify: 2017-05-13 19:09:30.760094062 +0100 Change: 2017-05-13 19:09:30.760094062 +0100 Birth: -
Err, well. No birth date? ext4 does support file creation timestamps, so it’s just a simple matter of getting at them.
Enter debugfs, part of e2fsprogs (at least on this Arch install). We can stat an inode to get a creation time:
$ stat -c %i ~/scripts/goprofootage.sh
792618
# debugfs -R 'stat <792618>' /dev/mapper/840ssd-home
debugfs 1.43.7 (16-Oct-2017)
Inode: 792618 Type: regular Mode: 0755 Flags: 0x80000
Generation: 3863725318 Version: 0x00000000:00000001
User: 1000 Group: 1000 Project: 0 Size: 1001
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x59174bda:b53875b8 -- Sat May 13 19:09:30 2017
atime: 0x5a51d8e8:c2b56548 -- Sun Jan 7 08:23:04 2018
mtime: 0x59174bda:b53875b8 -- Sat May 13 19:09:30 2017
crtime: 0x58efaf27:2234f628 -- Thu Apr 13 18:02:31 2017
Size of extra inode fields: 32
EXTENTS:
(0):5096134
Or, if you’d rather combine the above into a one-liner (NB needs root):
# debugfs -R "stat <$(stat -c %i ~/scripts/goprofootage.sh)>" /dev/mapper/840ssd-home 2>/dev/null | grep crtime | cut -d ' ' -f4-9
Thu Apr 13 18:02:31 2017