How to tell which file is original if hard link is created

You can't, because they are literally the same file, only reached by different paths. The first one has no special status.


There is no direct, clean (reliable) way to do that. But under appropriate circumstances this can be possible (or at least probable). The problem is that there are two hard links but just one file. Change, modification and (maybe) creation time are stored for files (inodes) only but not for directory entries (the hard links). Thus the information you want can be taken from secondary effects only which can be easily destroyed by operations which are not related to the file. And you cannot even see whether it has been destroyed. You can only know that from the operational circumstances if you are precisely aware of them.

The creation of a hard link is a write operation to the directory which contains the link. Thus it updates the directory's mtime. So if

  1. the links are in different directories

  2. and you know that none of these directories has been changed (file added, deleted, renamed or file metadata change) after the second hard link has been created then you can simply compare the mtimes of the directories.

Special case: If one of the directories has an mtime before the file's (inode's) mtime and you can be reasonably sure that the file has not been written later than a short moment after its creation then this directory's link is the older one.

If the links are in the same directory (which seems to be the case in your question) then it gets worse. Then you can use

ls -lU

in order to get an impression of the order in which the entries have been created. That need not be the correct order as entries may be deleted so that new entries are made in the middle of the directory list. And as Gilles pointed out it doesn't work at all with newer filesystems.


If you rely on the last modification time of the directories and you don't have knowledge of how and when those directories are changed, relying on mtime is going to lead you to be wrong some percentage of the time. The issue here is that the file is represented in the filesystem by an inode, not by a directory entry. The directory entry (filename) points to the inode, not the file.

I think I'd be doing some navel gazing about why I need to know which directory entry is older and how to avoid needing to know that.