The BSDs, Windows, OS X, and Mac OS classic and their corresponding filesystems all supported this for decades. Linux is the only major holdout, because according to Linus, "it's all totally useless and people can't even agree on a name." [1]

[1] https://lwn.net/Articles/397445/

Yet creation time is still useless in this case, because forging it is still trivial [0][1].

A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust.

Without that, and with incentive, this becomes nothing more than a farce.

[0] https://www.howtogeek.com/203154/how-to-change-created-or-mo...

[1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1

Thanks for that. I know that the inode structure doesn't, or at least didn't return this, for a long time (occupational hazard: outliving your education's "best used by" date). Which was why I'd already edited the initial "most" to "many" describing filesystems above (prior to posting).

I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.