💾 Archived View for thrig.me › blog › 2024 › 02 › 24 › creation-time.gmi captured on 2024-03-21 at 15:04:14. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
Does not exist. Well, maybe it does; this really depends on the filesystem. Some filesystems support a file creation time, and others do not. But what about the "ctim" field as mentioned in stat(2)? Is that not short for "creation time"? Nope.
$ df /tmp
Filesystem 512-blocks Used Avail Capacity Mounted on
/dev/sd0d 8114908 64 7709100 1% /tmp
$ grep /tmp /etc/fstab
38fcd6f796507fa1.d /tmp ffs rw,nodev,nosuid,noatime 1 2
$ cd /tmp
$ rm foo
rm: foo: No such file or directory
$ touch foo
$ stat -t '%Y-%m-%d %H:%M:%S' -f %Sc foo
2024-02-24 02:25:51
$ sleep 60 ; chmod go-rwx foo ; stat -t '%Y-%m-%d %H:%M:%S' -f %Sc foo
2024-02-24 02:26:57
So the "st_ctim" field holds the time of the last file status change, which does happen on file creation, but also happens when various other sorts of status changes occur, such as a chmod. Any file status change will destroy the previous record, so "st_ctim" may or may not reflect when the file was created.
$ man 2 stat | grep time | sed 3q
struct timespec st_atim; /* time of last access */
struct timespec st_mtim; /* time of last data modification */
struct timespec st_ctim; /* time of last file status change */
To be fair, there are some file systems that support a "creation time" (some label it as "birth time") as distinct from the st_ctim "file status change", but you may not have one of those, and this field probably does not use the st_ctim field.
$ man 1 stat | perl -00 -ne 'print if m/birth/'
a, m, c, B
The time file was last accessed or modified, or when the
inode was last changed, or the birth time of the inode
(st_atime, st_mtime, st_ctime, st_birthtime). If the
file system does not support birth time, the value is
undefined.
P.S. If you are trying to fake timestamps it's probably best to change the system clock, especially if you are using some complicated Office Suite that may embed timestamps internally in the probably opaque and complicated file format. There is also a utimes(2) call, and doubtless various non-portable things depending on the specific operating system or filesystem involved.