If you use a tool like perl or 'C' you will have access to three file atributes, ctime, atime and mtime which are creation time, access time, and modified time. That's the good news. The bad news is that
none of these are to be trusted.
mtime is the most accurate of the lot but can be easily altered using 'touch' so is insufficient for a proper audit.
ctime is actually the modify time of the inode. In many cases this will equal creation time but, again, you shouldn't rely on it.
atime is the last time the file was read but is even more unreliable.
Having said all this most versions of find allow for the -ctime flag so, will all the provisos in mind,
will find all the files created three days ago.
Ceci n'est pas une signature
Columb Healy