EXT3/4 does in fact track creation time, but the Unix-style fstat() doesn't have a field to return creation time. You can use debugfs to retrieve it once you have the inode and device: http://unix.stackexchange.com/questions/50177/birth-is-empty...

NTFS tracks creation time also, and it's available as one of the columns to sort by in Explorer.

The BSDs, Windows, OS X, and Mac OS classic and their corresponding filesystems all supported this for decades. Linux is the only major holdout, because according to Linus, "it's all totally useless and people can't even agree on a name." [1]

[1] https://lwn.net/Articles/397445/

Yet creation time is still useless in this case, because forging it is still trivial [0][1].

A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust.

Without that, and with incentive, this becomes nothing more than a farce.

[0] https://www.howtogeek.com/203154/how-to-change-created-or-mo...

[1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1

Thanks for that. I know that the inode structure doesn't, or at least didn't return this, for a long time (occupational hazard: outliving your education's "best used by" date). Which was why I'd already edited the initial "most" to "many" describing filesystems above (prior to posting).

I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.