# Linux VFS gains proposed Provenance Time timestamp for cross-filesystem content tracking

> **Key takeaway:** A new 'ptime' timestamp would preserve original file creation dates across filesystem copies and conversions, complementing existing birth time with user-settable provenance semantics.

**Published:** 2026-10-28T12:23:10+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/linux-vfs-gains-proposed-provenance-time-timestamp-for-cross.html 

## Summary
Linux kernel developer Amir Goldstein has posted request-for-comments patches introducing Provenance Time (ptime), a new timestamp designed to track when file contents were originally created regardless of subsequent filesystem boundaries. Unlike the existing birth time (btime), which records inode creation on the current filesystem, ptime would be user-settable and preserved during backups, archives, and filesystem migrations. The initial implementation covers the kernel VFS layer and Btrfs, with proof-of-concept Coreutils patches enabling ptime support in stat and cp commands.

The proposal establishes a semantic parallel between ptime and mtime: just as modification time tracks when content last changed, provenance time tracks when content first originated. This addresses practical scenarios where users copy long-lived files like shell histories across filesystems and want to retain original creation metadata. The patches are currently at RFC stage and would require broader filesystem adoption beyond Btrfs to become generally useful.

## VFS semantics and filesystem implementation
- **VFS layer integration:** The RFC patches add ptime infrastructure to the Linux kernel's virtual filesystem layer, making it available for any filesystem driver to implement.
- **Btrfs initial implementation:** Btrfs serves as the reference filesystem for proving the ptime concept, with changes to store and retrieve the new timestamp in its on-disk format.
- **User-settable semantics:** Unlike btime, ptime can be explicitly set by userspace tools, enabling preservation across backup restores, filesystem conversions, and archive extractions.
- **Coreutils proof-of-concept:** Patches for stat and cp demonstrate practical userspace usage, showing how ptime would surface in everyday command-line file operations.
- **Correspondence with existing timestamps:** The design pairs ptime with mtime (both track content lineage) while btime pairs with ctime (both track inode lifecycle events).

## Why it matters
For Linux distributions and backup tool developers, ptime offers a path to more accurate file provenance tracking in an era of frequent filesystem migrations and cloud storage synchronization. If adopted beyond Btrfs to ext4, XFS, and ZFS, it would give system administrators and end users reliable metadata for forensic analysis, data lifecycle management, and personal file organization. The Coreutils patches suggest immediate utility for common workflows, though widespread adoption depends on filesystem maintainer buy-in and potential POSIX standardization discussions.