« Back to Frequently Asked Questions

How to see the creation date of a file

The creation date of a file can be displayed on a Linux system using the stat command. That is, if the file system on the Linux system supports this particular piece of information. If so, then it is stored in the btime or birth time. In 2017 this initial support was added.

Showing the birth time of a file

One option is to run stat with only the file name as its parameter.

# stat /etc/passwd
  File: /etc/passwd
  Size: 1993      	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 132674      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2024-05-08 19:17:01.959352190 +0000
Modify: 2024-02-02 19:14:45.316650111 +0000
Change: 2024-02-02 19:14:45.320650046 +0000
 Birth: 2024-02-02 19:14:45.316650111 +0000

The output will display the time stamps. If the birth time is available, it will be displayed on the line starting with Birth:, followed by a human readable value. If the birth time is not available, you may see a dash, empty value, or a zero (0).

If you just want to see the related line, use the --format option.

# stat --format=%w /etc/passwd
2024-02-02 19:14:45.316650111 +0000

Prefer a Unix timestamp (time in seconds since epoch) instead?

# stat --format=%W /etc/passwd


Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution.

Mastodon icon