Linux查看文件的最初创建日期时间crtime

有时候啊，我们要查看一个文件的最初创建时间，但找来找去，都是Access time，Modified tiime和Changed time，用stat也没法查到文件的最初创建时间。
实际上是有办法查看的，用debugfs命令就可以查到。

File creation time is stored in inode in EXT4 file system. An earlier version of EXT files systems doesn’t support file creation time.

1 找到文件的inode

[root@246 ~]# ls -i install.log
130307 install.log

2 用debugfs命令查看，debugfs -R 'stat <inode_number>' /dev/xxxxxx，后面是所在的分区

[root@246 ~]# debugfs -R 'stat <130307>' /dev/mapper/vg_template-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 130307   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 2239490367    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 8837
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 24
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5dba8b6b:081b3228 -- Thu Oct 31 15:21:15 2019
 atime: 0x61ad61e9:35985484 -- Mon Dec  6 09:05:45 2021
 mtime: 0x5dba8b66:68e77828 -- Thu Oct 31 15:21:10 2019
crtime: 0x5dba8ade:3b5dc124 -- Thu Oct 31 15:18:54 2019
Size of extra inode fields: 28
Extended attributes stored in inode body: 
  selinux = "system_u:object_r:admin_home_t:s0\000" (34)
EXTENTS:
(0): 3178550, (1): 3178587, (2): 3178718
[root@246 ~]# 

其中上面的crtime就是最初创建时间

参考资料：https://tecadmin.net/file-creation-time-linux/