Linux 如何在 Bash/Debian 中获取文件创建日期/时间？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/14842195/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to get file creation date/time in Bash/Debian?
提问by NoodleFolk
I'm using Bash on Debian GNU/Linux 6.0. Is it possible to get the file creation date/time? Not the modification date/time.
ls -lh a.txtand stat -c %y a.txtboth only give the modification time.
我在 Debian GNU/Linux 6.0 上使用 Bash。是否可以获取文件创建日期/时间？不是修改日期/时间。
ls -lh a.txt并且stat -c %y a.txt两者都只给出修改时间。
采纳答案by mikyra
Unfortunately your quest won't be possible in general, as there are only 3 distinct time values stored for each of your files as defined by the POSIX standard (see Base Definitions section 4.8 File Times Update)
不幸的是，您的任务通常是不可能的，因为按照 POSIX 标准的定义，您的每个文件只存储了 3 个不同的时间值（请参阅基本定义部分 4.8 文件时间更新）
Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in <sys/stat.h>.
每个文件都有三个不同的相关时间戳：上次访问数据的时间、上次修改数据的时间和上次更改文件状态的时间。这些值在文件特征结构struct stat中返回，如<sys/stat.h> 中所述。
EDIT: As mentioned in the comments below, depending on the filesystem used metadata may contain file creation date. Note however storage of information like that is non standard. Depending on it may lead to portability problems moving to another filesystem, in case the one actually used somehow stores it anyways.
编辑：正如下面的评论中提到的，根据使用的文件系统，元数据可能包含文件创建日期。但请注意，此类信息的存储是非标准的。依赖于它可能会导致迁移到另一个文件系统的可移植性问题，以防实际使用的文件系统以某种方式存储它。
回答by NoodleFolk
Creation date/time is normally notstored. So no, you can't.
创建日期/时间通常不存储。所以不，你不能。
回答by unit3
Note that if you've got your filesystem mounted with noatime for performance reasons, then the atime will likely show the creation time. Given that noatime results in a massive performance boost (by removing a disk write for every time a file is read), it may be a sensible configuration option that also gives you the results you want.
请注意，如果出于性能原因使用 noatime 挂载了文件系统，则 atime 可能会显示创建时间。鉴于 noatime 导致巨大的性能提升（通过在每次读取文件时删除磁盘写入），它可能是一个明智的配置选项，也可以为您提供所需的结果。
回答by jason
mikyra's answer is good.The fact just like what he said.
mikyra 的回答很好。事实就像他说的那样。
[jason@rh5 test]$ stat test.txt
File: `test.txt'
Size: 0 Blocks: 8 IO Block: 4096 regular empty file
Device: 802h/2050d Inode: 588720 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 500/ jason) Gid: ( 500/ jason)
Access: 2013-03-14 01:58:12.000000000 -0700
Modify: 2013-03-14 01:58:12.000000000 -0700
Change: 2013-03-14 01:58:12.000000000 -0700
if you want to verify wich file was created first,you can structure your file name by appending system date when you create a series of files.
如果要验证首先创建的文件，可以在创建一系列文件时通过附加系统日期来构建文件名。
回答by GustavoH
ls -i menus.xml
ls -i 菜单.xml
94490 menus.xml Here the number 94490 represents inode
94490 menus.xml 这里的数字94490代表inode
Then do a:
然后做一个：
df -h
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg-root 4.0G 3.4G 408M 90% /
tmpfs 1.9G 0 1.9G 0% /dev/shm
/dev/sda1 124M 27M 92M 23% /boot
/dev/mapper/vg-var 7.9G 1.1G 6.5G 15% /var
To find the mounting point of the root "/" filesystem, because the file menus.xml is on '/' that is '/dev/mapper/vg-root'
找到根“/”文件系统的挂载点，因为文件menus.xml在'/'即'/dev/mapper/vg-root'
debugfs -R 'stat <94490>' /dev/mapper/vg-root
debugfs -R 'stat <94490>' /dev/mapper/vg-root
The output may be like the one below:
输出可能如下所示：
debugfs -R 'stat <94490>' /dev/mapper/vg-root
debugfs -R 'stat <94490>' /dev/mapper/vg-root
debugfs 1.41.12 (17-May-2010)
Inode: 94490 Type: regular Mode: 0644 Flags: 0x0
Generation: 2826123170 Version: 0x00000000
User: 0 Group: 0 Size: 4441
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 16
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
atime: 0x5266e47b -- Wed Oct 23 09:47:55 2013
mtime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
Size of extra inode fields: 4
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:usr_t:s0ctime: 0x5266e438 -- Wed Oct 23 09:46:48 2013
0" (31)
BLOCKS:
(0-1):375818-375819
TOTAL: 2
Where you can see the creation time:
在哪里可以看到创建时间：
ls -i file #output is for me 68551981
debugfs -R 'stat <68551981>' /dev/sda3 # /dev/sda3 is the disk on which the file exists
#results - crtime value
[root@loft9156 ~]# debugfs -R 'stat <68551981>' /dev/sda3
debugfs 1.41.12 (17-May-2010)
Inode: 68551981 Type: regular Mode: 0644 Flags: 0x80000
Generation: 769802755 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 38973440
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 76128
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
atime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013
mtime: 0x526931d7:1697cce0 -- Thu Oct 24 16:42:31 2013
**crtime: 0x52691f4d:7694eda4 -- Thu Oct 24 15:23:25 2013**
Size of extra inode fields: 28
EXTENTS:
(0-511): 352633728-352634239, (512-1023): 352634368-352634879, (1024-2047): 288392192-288393215, (2048-4095): 355803136-355805183, (4096-6143): 357941248-357943295, (6144
-9514): 357961728-357965098
回答by user2725883
ls -lit /path
回答by Luca Davanzo
As @mikyra explained, creation date time is not stored anywhere.
正如@mikyra 解释的那样，创建日期时间不会存储在任何地方。
All the methods above are nice, but if you want to quickly get only last modify date, you can type:
上面的所有方法都很好，但如果你想快速获得最后修改日期，你可以输入：
while true; do
change=$(inotifywait -e close_write,moved_to,create .)
change=${change#./ * }
if [ "$change" = ".*" ]; then ./scriptToStoreInfoAboutFile; fi
done
with -toption you list all file in /path odered by last modify date.
使用-t选项可以列出上次修改日期之前 /path 中的所有文件。
回答by william.eyidi
If you really want to achieve that you can use a file watcher like inotifywait.
如果你真的想实现这一点，你可以使用像inotifywait这样的文件观察器。
You watch a directory and you save information about file creations in separate file outside that directory.
您观察一个目录并将有关文件创建的信息保存在该目录外的单独文件中。
$ ls -l --time-style=long-iso | sort -k6
total 692
-rwxrwx---+ 1 XXXX XXXX 249159 2013-05-31 14:47 Getting Started.pdf
-rwxrwx---+ 1 XXXX XXXX 275799 2013-12-30 21:12 TheScienceofGettingRich.pdf
-rwxrwx---+ 1 XXXX XXXX 25600 2015-05-07 18:52 Thumbs.db
-rwxrwx---+ 1 XXXX XXXX 148051 2015-05-07 18:55 AsAManThinketh.pdf
As no creation time is stored, you can build your own system based on inotify.
由于不存储创建时间，因此您可以基于 inotify 构建自己的系统。
回答by zanfilip
You can find creation time - aka birth time - using statand also match using find.
We have these files showing last modified time:
您可以使用stat找到创建时间 - 也就是出生时间 -也可以使用find 进行匹配。
我们有这些文件显示上次修改时间：
$ find -newerBt '2014-06-13' ! -newerBt '2014-06-13 12:16:10' -ls
20547673299906851 148 -rwxrwx--- 1 XXXX XXXX 148051 May 7 18:55 ./AsAManThinketh.pdf
1407374883582246 244 -rwxrwx--- 1 XXXX XXXX 249159 May 31 2013 ./Getting\ Started.pdf
To find files created within a certain time frame using findas below.
Clearly, the filesystem knows about the birth time of a file:
使用find 查找在特定时间范围内创建的文件，如下所示。
显然，文件系统知道文件的诞生时间：
$ stat -c "%w %n" * | sort
2014-06-13 12:16:03.873778400 +0100 AsAManThinketh.pdf
2014-06-13 12:16:04.006872500 +0100 Getting Started.pdf
2014-06-13 12:16:29.607075500 +0100 TheScienceofGettingRich.pdf
2015-05-07 18:32:26.938446200 +0100 Thumbs.db
We can confirm this using stat:
我们可以使用 stat 来确认这一点：
%w time of file birth, human-readable; - if unknown
statman pages explains %w:
统计手册页解释了 %w：
get_crtime() {
for target in "${@}"; do
inode=$(stat -c %i "${target}")
fs=$(df "${target}" | tail -1 | awk '{print }')
crtime=$(sudo debugfs -R 'stat <'"${inode}"'>' "${fs}" 2>/dev/null | grep -oP 'crtime.*--\s*\K.*')
printf "%s\t%s\n" "${target}" "${crtime}"
done
}
回答by Mike Chen
Cited from https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/131347#131347, the following shellscript would work to get creation time:
从https://unix.stackexchange.com/questions/50177/birth-is-empty-on-ext4/131347#131347引用，以下 shellscript 可以用来获取创建时间：
##代码##