Originally posted by: dansilva

Hi Folks,

I need to know when a specific file was created. It has already been modified; what I need is the date it was created. Is this possible?

Not sure this works, but I found this on a newsgroup search in google:

"Yes it is possible but not so easy:

1. ls -li (-> get inode-Number of file and remember it)
2. fsdb /FILESYSTEMNAME (-> possible /home or /etc or...)
now you are in a inputline. just write:

inode-Number i

on the 5. line you can see follwing:

at: Thu Jan 01 01:00:00 1970

that the creation date of the file ! "

Thanks!

Originally posted by: SystemAdmin

$ ls -li /webpage/aixtips/for*
65756 -rw-r--r-- 1 jwtesch staff 41798 Jun 01 19:50 /webpage/aixtips/forensics.html
$ fsdb /webpage
..
65756 i
i#: 65756 md: f---rw-r--r-- ln: 1 uid: 500 gid: 1
szh: 0 szl: 41798 (actual size: 41798)
Single indirect block: 0x104fb
at: Thu Jun 08 11:00:14 2006
mt: Thu Jun 01 19:50:32 2006
ct: Thu Jun 01 19:50:32 2006

I think ct is created, mt is modified, and at is viewed.

But also you can use the find command with the -ctime to find files created within a certain amount of time. A good find tutorial can be found at:
http://www.softpanorama.org/Tools/Find/find_mini_tutorial.shtml

But when I tried this -ctime and -mtime, it showed me the -mtime of these files
$ find /webpage -mtime -6 -print
/webpage/aixldap/index.html
$ find /webpage -ctime -6 -print
/webpage/aixldap/index.html
$ ls -lc /webpage/aixldap/index.html
-rw-r--r-- 1 jwtesch staff 46123 Jun 07 19:56 /webpage/aixldap/index.html

This file was modifed on Jun 07, not created.
$ ls -il /webpage/aixldap/index.html
79909 - inode for the file
$ fsdb /webpage
File System: /webpage

File System Size: 917504 (512 byte blocks)
Disk Map Size: 9 (4K blocks)
Inode Map Size: 9 (4K blocks)
Fragment Size: 4096 (bytes)
Allocation Group Size: 2048 (fragments)
Inodes per Allocation Group: 2048
Total Inodes: 114688
Total Fragments: 114688

79909 i
i#: 79909 md: f---rw-r--r-- ln: 1 uid: 500 gid: 1
szh: 0 szl: 46123 (actual size: 46123)
Single indirect block: 0x139fa
at: Thu Jun 08 08:34:26 2006
mt: Wed Jun 07 19:56:14 2006
ct: Wed Jun 07 19:56:14 2006

So not really creation time maybe on AIX.

Originally posted by: SystemAdmin

Unix Filesystems store 3 Timestamps for Filesystem objects

ATIME - object last accessed
CTIME - objects' inode last changed (with chown or chmod e.g.)
MTIME - object last modified

The objects' creation timestamp is not stored (in contrast to NTFS for example).
On AIX5 the istat(1) command lists all 3 timestamps.

Regards
Joachim