Is there some special reason that Windows can tell you a file's creation time, but Linux generally does not?

wh33t · 03-26-2024, 05:42 PM

I just learned about the

Code:

stat

command and am sad to see that the Birth time is always empty

GazL · 03-26-2024, 06:14 PM

Historically UNIX hasn't stored the birth information.

I guess the guys who designed the UNIX filesystem were happy enough with just having Modification time and saw no use for birth time. Keep in mind that back then disks weren't very big and an extra (arguably useless) timestamp field for every file would be considered wasteful.

BTW, birthtime isn't always empty on linux. Depends on the filesystem type.

michaelk · 03-26-2024, 06:34 PM

Quote:

BTW, birth time isn't always empty on linux. Depends on the filesystem type.

And kernel version. As of version 4.11 or so system calls to retrieve birth time have been available but yes it also depends on filesystem type. The birth time is "stored" in the file's inode but has not been readily available to the user.

wpeckham · 03-26-2024, 08:11 PM

And, just so you are aware, while Linux does not report that time Windows will. But it often lies!

Unix style file systems have interesting time stamps, that reflect the philosophy and expected use of the file system. The time it was created is not interesting to Unix/Linux systems, but the last time it was MODIFIED matters! For some things, the last time it was ACCESSED used to matter, but very little uses that these days.

At core: Windows is not Linux, and Linux is not Windows, and no one should expect them to act the same way. EVER!

pan64 · 03-27-2024, 02:17 AM

not to speak about a lot of "questions", like what would be the creation time when you move/copy a file to another location? Should it keep the old value, or should it be the current time (since a new file was created). When you edit a file usually the old version is removed and a new file is created. Should it keep that creation time (time of birth)? What would be the creation time when you restore something from backup (on a different host/disk)? Or what should be used when you install (download) a package? Keep the time when the package was created?

For example git does not care about it at all.

mjolnir · 03-27-2024, 04:59 AM

You can use 'stat' to get a files inode number and then 'debugfs' to get atime, ctime, mtime and crtime (creation time.) A search for stat and debugfs should turn up some methods for you. There will be cautions against 'borking' your system.

hazel · 03-27-2024, 06:40 AM

Quote:

Originally Posted by pan64

When you edit a file usually the old version is removed and a new file is created. Should it keep that creation time (time of birth)? What would be the creation time when you restore something from backup (on a different host/disk)? Or what should be used when you install (download) a package? Keep the time when the package was created?

We had Vax minicomputers at work and they ran VMS. VMS filenames had a generation number as well as a name. istr it was appended to the name (where required) with a semicolon. If you edited a file and wrote it back, it was given a different number but the old version was not deleted unless you specified that it should be. The default version was always the latest one, so most people didn't bother with these numbers, but they must have been very useful for developers.

pan64 · 03-27-2024, 06:43 AM

Quote:

Originally Posted by hazel

We had Vax minicomputers at work and they ran VMS. VMS filenames had a generation number as well as a name. istr it was appended to the name (where required) with a semicolon. If you edited a file and wrote it back, it was given a different number but the old version was not deleted unless you specified that it should be. The default version was always the latest one, so most people didn't bother with these numbers, but they must have been very useful for developers.

Yes, I remember that.

boughtonp · 03-27-2024, 10:20 AM

Quote:

Originally Posted by wpeckham

At core: Windows is not Linux, and Linux is not Windows, and no one should expect them to act the same way. EVER!

People on LQ trotting out this crap every time someone contrasts to Windows is tiring, and that ridiculous "EVER!" is simple nonsense.

Yes, there are plenty of underlying differences - and historic rationales for those differences - but there are also numerous examples where one has copied a feature from the other (and vice versa), or both have copied from somewhere else, because that particular feature is useful for users. The usefulness of features can sometimes only takes a short while to realise, whilst other times it can takes decades.

There will also probably always be some underlying differences, because people have different needs. Understanding why there are differences can be useful and interesting. Telling people to "just accept it" is not.

Quote:

Originally Posted by wh33t

I just learned about the [stat] command and am sad to see that the Birth time is always empty

Here's a blog post that looks into it: //blog.marbu.eu/posts/2019-02-17-btime/

You might also find the links at the bottom interesting.

sundialsvcs · 03-27-2024, 11:29 AM

“And then, what happens next?” “Network file systems!” Every one of them more-or-less different. So it goes …

jayjwa · 03-27-2024, 01:41 PM

I'm confused. XFS, EXT4 and even VFAT appear to show Birth time.

Code:

stat maps.txt
  File: maps.txt
  Size: 734             Blocks: 8          IO Block: 4096   regular file
Device: 8,3     Inode: 578934      Links: 1
Access: (0600/-rw-------)  Uid: ( 1000/  jayjwa)   Gid: ( 1000/   users)
Access: 2024-03-27 13:22:31.560205582 -0400
Modify: 2024-03-12 20:59:31.379412431 -0400
Change: 2024-03-12 20:59:31.379412431 -0400
 Birth: 2024-03-12 20:59:31.379412431 -0400

stat /var/log/Xorg.0.log 
  File: /var/log/Xorg.0.log
  Size: 58348           Blocks: 120        IO Block: 4096   regular file
Device: 8,2     Inode: 11534345    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: ( 1000/   users)
Access: 2024-03-20 17:42:48.491800025 -0400
Modify: 2024-02-15 15:08:27.794195205 -0500
Change: 2024-02-15 15:08:27.794195205 -0500
 Birth: 2024-02-15 14:59:57.879718647 -0500

stat /boot/efi/EFI/Boot/bootx64.efi 
  File: /boot/efi/EFI/Boot/bootx64.efi
  Size: 1053248         Blocks: 2064       IO Block: 4096   regular file
Device: 8,1     Inode: 11          Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-08-31 00:00:00.000000000 -0400
Modify: 2023-07-16 13:06:16.000000000 -0400
Change: 2023-07-16 13:06:16.000000000 -0400
 Birth: 2023-07-16 13:06:17.640000000 -0400

Whether they are accurate or not I can not say, but the field is present.

VMS versioning can be a bother but has come in handy once in awhile.

Code:

$ dump /HEADER TEST.MEM

Dump of file DUA1:[JAYJWA]TEST.MEM;11 on 27-MAR-2024 14:25:45.95
File ID (48,21418,0)   End of file block 2 / Allocated 3

                             File Header

Header area
    Identification area offset:           40
    Map area offset:                      100
    Access control area offset:           255
    Reserved area offset:                 255
    Extension segment number:             0
    Structure level and version:          2, 1
    File identification:                  (48,21418,0)
    Extension file identification:        (0,0,0)
    VAX-11 RMS attributes
        Record type:                      Variable
        File organization:                Sequential
        Record attributes:                <none specified>
        Record size:                      72
        Highest block:                    3
        End of file block:                2
        End of file byte:                 440
        Bucket size:                      0
        Fixed control area size:          0
        Maximum record size:              0
        Default extension size:           0
        Global buffer count:              0
        Directory version limit:          0
    File characteristics:                 <none specified>
    Caching attribute:                    Writethrough
    Map area words in use:                2
    Access mode:                          0
    File owner UIC:                       [JAYJWA]
    File protection:                      S:RWED, O:RWED, G:RE, W:
    Back link file identification:        (19,1,0)
    Journal control flags:                <none specified>
    Active recovery units:                None
    Highest block written:                2
    Client attributes:                    None

Identification area
    File name:                            TEST.MEM;11
    Revision number:                      1
    Creation date:                        11-FEB-2024 19:04:54.72
    Revision date:                        11-FEB-2024 19:04:54.77
    Expiration date:                      <none specified>
    Backup date:                          <none specified>

Map area
    Retrieval pointers
        Count:          3        LBN:        789

Checksum:                                 62222

michaelk · 03-27-2024, 02:25 PM

It depends on two things i.e. the kernel version i.e. 4.11+ and the version of the utilities i.e stat itself.

sundialsvcs · 03-27-2024, 03:44 PM

Some filesystems record this information. Others do not. "There are no promises."

wpeckham · 03-27-2024, 03:54 PM

Quote:

Originally Posted by boughtonp

People on LQ trotting out this crap every time someone contrasts to Windows is tiring, and that ridiculous "EVER!" is simple nonsense.

Yes, there are plenty of underlying differences - and historic rationales for those differences - but there are also numerous examples where one has copied a feature from the other (and vice versa), or both have copied from somewhere else, because that particular feature is useful for users. The usefulness of features can sometimes only takes a short while to realise, whilst other times it can takes decades.

There will also probably always be some underlying differences, because people have different needs. Understanding why there are differences can be useful and interesting. Telling people to "just accept it" is not.

Which is why I FIRST explained the file system issues involved, and never told anyone to "just accept it"!
I recommend they EXPECT it, which is a different thing. I also encourage people to ADD capabilities or features to Linux if they have the ability and really want that. We cannot do that to Windows (or other closed-source software) but we absolutely CAN do that with Linux!

replica9000 · 03-27-2024, 05:41 PM

Both zfs and tmpfs give me a birth time for files on my system. However, if I stat the same files over sshfs, the birth field is empty.