John's Corner

Get embedded dates from files

This tip covers how to extract create and modify dates from files programmatically.

The time and date information associated with files such as creation date or last modified date, are generally captured in two ways. One way is to use the file system to capture it. All file systems do this, so it is a reliable way to get time and date information, but the time and date returned might not always be what they seem. This is particularly true for the create date. It will only be true for the file system on which the file was originally created. Any file copied to another file system will return the date it was created on that file system.

Another way is to store this information within the file, so that is always with the file, no matter where is is copied to. Time and dates stored within the file will carry across to any subsequent copies on other file systems.

Not all files have the ability to store time/date information within the file. Legacy DOS and Windows files did not have this but the capability was added by Microsoft and third parties to some file types as native Win32 systems became dominant.

The commands below are for Unix/Linux based systems for the file types indicated:

• Requires Imagemagick to be installed.
• Get create date from image
  identify -verbose esta-today.png | grep "date:create" | sed -r 's/^.* (.*)T.*/\1/'
• Get modify date from image
  identify -verbose esta-today.png | grep "date:modify" | sed -r 's/^.* (.*)T.*/\1/'
• Returns a date string in format
  2019-04-19T08:15:18+10:00

PDF Files

• Requires Poppler tools to be installed.
• Get Create date from file
  pdfinfo noforecast.pdf | grep "CreationDate:" | sed -r 's/(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/\4 \3 \6/'
• Get Modify date from file
  pdfinfo noforecast.pdf | grep "ModDate:" | sed -r 's/(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/\4 \3 \6/'