Several methods exist to find out the possible system installation date and time. The first method we use is the Debian Installer log. It should work on all Debian based distributions such as Ubuntu. The following command will show the content of the log with timestamps. Scroll up to find the earliest timestamps.

cat /var/log/installer/syslog

Or otherwise, instead of printing the complete log with the cat command, just print the first few lines using the head command. The following command will print the same Debian Installer log but only the first 10 lines.

head -10 /var/log/installer/syslog

Also, go to the /var/log/installer directory and inspect the creation dates of the files inside that directory.

ls -l --full-time /var/log/installer/

Another approach is finding the oldest file in the system. This method should work on almost all the systems regardless of their distribution. Run the following command.

  • --full-time will display the date and time in long format.
  • -talc display files as a list, sorting by the modified time from newest to oldest.
  • tail -1 display only the last line.
ls --full-time -talc / | tail -1

It should display the date and time of the lost+found directory. If you need, you can also directly get the date and time of the lost+found directory with the following command.

ls -ld --full-time /lost+found