How to Retrieve File Creation, Access, and Modification Timestamps on Linux (ext4)

Background : When analyzing backup files such as xtrabackup_log , it is often necessary to know the file's creation and modification timestamps.

Linux file timestamps : Linux stores three timestamps for each file—ATime (last access), MTime (last content modification), and CTime (last metadata change). These can be viewed with the stat command.

# stat 2.txt

Example output shows the Access (ATime), Modify (MTime), and Change (CTime) fields. Reading a file updates ATime, writing updates MTime, and changing permissions or ownership updates CTime.

Do not edit files with vi if you need to preserve the original inode, as vi may cause inode changes.

Why there is no creation time : Traditional Linux filesystems (e.g., ext2/3) do not store a creation timestamp. Starting with ext4, the inode includes a crtime field, allowing retrieval of the file’s creation time.

Getting creation time on ext4 :

Obtain the file’s inode number with stat or ls -i .

Identify the device that holds the inode (e.g., /dev/sdc1 ) using df -h .

Use debugfs to query the inode: debugfs -R 'stat <inode>' /dev/sdc1 . The output contains a crtime line with the creation timestamp.

Example:

# debugfs -R 'stat <14>' /dev/sdc1
crtime: 0x5d3691c7:6e5dbb68 -- Tue Jul 23 12:49:11 2019

Shell script to automate the process (saved as statx ):

#!/bin/sh
[ $# -ne 1 ] && echo "Usage: $0 {FILENAME}" && exit 1
INODE=`ls -i $1 | awk '{print $1}'`
FILENAME=$1
# Determine mount point and ensure it is ext4
`echo $FILENAME | grep / 1>/dev/null` && { FPWD=${FILENAME%/*}; FPWD=${FPWD:=/}; cd ${FPWD}; FPWD=`pwd`; } || FPWD=`pwd`
array=(`echo ${FPWD} | sed 's@/@ @g'`)
array_length=${#array[@]}
for ((i=${array_length};i>=0;i--))
do
  unset array[$i]
  SUBPWD=`echo " ${array[@]}" | sed 's@ @/@g'`
  DISK=`df -h | grep ${SUBPWD}$ | awk '{print $1}'`
  [[ -n $DISK ]] && break
done
[[ "`mount | grep ${DISK} | awk '{print $5}'`" != "ext4" ]] && { echo "${DISK} is not mounted as ext4!"; exit 2; }
debugfs -R "stat <${INODE}>" ${DISK}

Make the script executable, place it in /usr/sbin , and run statx filename to see crtime , atime , and mtime .

Practical verification : Using the script, the author confirmed that xtrabackup_logfile is the earliest created file and that the final backup file has the latest modification time, validating the steps in the xtrabackup workflow diagram.