Missing creation dates on files

[ZoW7iV8]

Sometime between February 19 and today, "something" has wiped the creation file stamps on all my document files. Modified dates are still there. And directories still have creation dates. When I open a markdown file in a text editor, for example, it will show the correct modification date, and the creation date as: 1969-12-31 19:00. I've searched enough to understand that this is Unix Epoch time. I am unsure what my next step should be.

[Kadaitcha Man]

I am unsure what my next step should be.

Make a backup, immediately.

[ZoW7iV8]

I have backups of all my data. I notice they too do not have file creation dates. I also have a Timeshift from 10 days ago. Each new file I create now also does not have a creation date. Should I restore from Timeshift, or is my hard drive failing? Can I troubleshoot? How? Would greatly appreciate some guidance what my next step should be.

[t42]

The file creation time in Ext4 is not directly accessible.
It's called 'Birth time' by stat command.
If you use stat command on ext4 the Birth field is - :

Code: Select all

stat 1.deb

  File: 1.deb
  Size: 264188    	Blocks: 520        IO Block: 4096   regular file
Device: 34h/52d	Inode: 2           Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/       v)   Gid: ( 1000/       v)
Access: 2021-02-23 13:03:50.546404805 +0200
Modify: 2021-02-23 13:03:50.566405061 +0200
Change: 2021-02-23 14:39:23.989398374 +0200
Birth: -

If you really need it you can get the creation time via debugfs:

Code: Select all

debugfs -R 'stat <inode_number>' DEVICE

for eg

Code: Select all

stat -c %i 1.deb
1440491
sudo debugfs -R 'stat <1440491>' /dev/sda3

output:

Code: Select all

Inode: 1440491   Type: regular    Mode:  0664   Flags: 0x80000
Generation: 1845404516    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 264188
File ACL: 0
Links: 1   Blockcount: 520
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x6034fb75:e918548c -- Tue Feb 23 14:56:21 2021
 atime: 0x6034e116:00000000 -- Tue Feb 23 13:03:50 2021
 mtime: 0x6034e116:00000000 -- Tue Feb 23 13:03:50 2021
crtime: 0x6034fb75:e918548c -- Tue Feb 23 14:56:21 2021
Size of extra inode fields: 32
Inode checksum: 0x921784b6
EXTENTS:
(0-64):5997855-5997919

[Hoser Rob]

You may be surprised to find out that Linux doesn't store file creation times. I certainly was. It's supported in the ext4 file system but not in the kernel APIs. So it doesn't get stored.

[t42]

It's supported in the ext4 file system but not in the kernel APIs.

That's true only till the dot. So I expanded my answer above a minute later after your comment.

[ZoW7iV8]

You may be surprised to find out that Linux doesn't store file creation times. I certainly was. It's supported in the ext4 file system but not in the kernel APIs. So it doesn't get stored.

Wow. Really. Then how is the column "Date Created" in Nemo displayed?

[ZoW7iV8]

The file creation time in Ext4 is not directly accessible.
It's called 'Birth time' by stat command.
If you use stat command on ext4 the Birth field is - :
... stat command stuff..

- deleted - please see better response below.

[t42]

Wow. Really. Then how is the column "Date Created" in Nemo displayed?

Nemo shows in the field Date Created the ctime - the last time when the attributes of a file were changed. Maybe it would be relevant for you to concentrate on the Date Modified filed of Nemo - just guessing. If I remember correctly there was a post this month similar to yours where the problem was comprehensively discussed, including terminology. You can try to search for that post.