[vox-tech] Stat a file's creation time

[Peter Jay Salzman]

hi sam,

it's my understanding that "creation time" is a misnomer.

ext2, ext3 and reiser don't keep track of a file's creation time.  what
people call "creation time" is (as you point out) something completely
different.

a better name for "creation time" is "the last time at which the inode
was modified".   so rather than keeping track of when the file was
created, it keeps track of things like:

* last date the file was mv'd
* last date a file's attr was changed
* last date the file's perms were changed
* last date the file's ownership or grownership was changed

stuff like that.

sorry to say, if you want to keep track of a file's original creation
date, you'll need to keep track of that yourself.

pete

ps- pass the crack pipe.  it's been a long day here too.



begin Sam Peterson <skpeterson@ucdavis.edu> 
> Hookay, maybe I'm trippin' but after reading the man pages for
> stat(1), ls, and stat(2), I'm beginning to think that Unix filesystems
> don't bother to keep track of the original creation date of a file.
> Not that this information has ever been terribly important to me, but
> I stumbled into it while I was writing a backup script for a small
> Linux server I use here at work.
> 
> Actually, it's not even important for me to have this information for
> my script.  I just thought I'd look up a few of my file's creation
> times out of curiosity while I was writing the script, which happens
> to be in perl and I was using the File::stat library.  I quickly
> noticed that there didn't seem to be a way to do it via perl's stat
> functions, so I tried the stat program.
> 
> The stat program lists Access, Modification, and Change times akin to
> atime, mtime, and ctime of perl's File::stat module, which are just
> tie-ins to stat(2) anyway.  Since I figured I was missing something, I
> experimented with the stat program and a text file and concluded.
> 
>   * Access time represents the last time the file was open to be read.
>   * Modification time represents the last time the file was written to
>     in any shape or form.
>   * Change time represents the last time any of the file's meta data
>     was altered, such as permissions, uid, gid, and size.  It often
>     coincides with modification time, because if a file's size is changed,
>     the meta data which keeps track of the size has to change to
>     represent that.
> 
> But someone please correct me if I've misunderstood what each one
> means.  Nothing above seems to represent the time that a file was
> originally created.  Granted that this isn't a very functionally
> important piece of information compared to the modification time of a
> file (at least for most purposes), but it seems like it'd be useful to
> someone, somewhere.
> 
> I ssh'ed into the isun servers and ran the same tests and sure enough
> same results, hmm, it's not just a linux-ism, it's a unix-ism.
> 
> Tripwire and Integrit keep file integrity databases and I imagine such
> information is present in those databases.  However, one would have to
> then run these systems and this information would have to be retreived
> programatically through provided libraries.  It just seems like this
> information would be important for someone to have if they needed it,
> and it would therefore be in the best interests of the filesystem to
> be keeping track of this information, not to rag on those open source
> developers; I certainly don't have the coding skills to write a unix
> file system, or provide a facility that may stray from the standards.
> 
> Maybe I'm on crack; it's been a long day after all.  Anybody know of a
> way to stat a file's original creation time on Unix or a standard
> external system that can be used to track such information?  Or is
> this from the "It's not important, so we don't care," department?  I
> have no need of the information currently, but this has dug into the
> better side of my curiosity.



-- 
Fingerprint: B9F1 6CF3 47C4 7CD8 D33E 70A9 A3B9 1945 67EA 951D