有时候啊，我们要查看一个文件的最初创建时间，但找来找去，都是Access time，Modified tiime和Changed time，用stat也没法查到文件的最初创建时间。
实际上是有办法查看的，用debugfs命令就可以查到。
File creation time is stored in inode in EXT4 file system. An earlier version of EXT files systems doesn’t support file creation time.
1 找到文件的inode
[root@246 ~]# ls -i install.log
130307 install.log
2 用debugfs命令查看，debugfs -R 'stat <inode_number>' /dev/xxxxxx，后面是所在的分区
[root@246 ~]# debugfs -R 'stat <130307>' /dev/mapper/vg_template-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 130307 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2239490367 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 8837
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 24
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5dba8b6b:081b3228 -- Thu Oct 31 15:21:15 2019
atime: 0x61ad61e9:35985484 -- Mon Dec 6 09:05:45 2021
mtime: 0x5dba8b66:68e77828 -- Thu Oct 31 15:21:10 2019
crtime: 0x5dba8ade:3b5dc124 -- Thu Oct 31 15:18:54 2019
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "system_u:object_r:admin_home_t:s0\000" (34)
EXTENTS:
(0): 3178550, (1): 3178587, (2): 3178718
[root@246 ~]#
其中上面的crtime就是最初创建时间
