The Linux operating system keeps track of three timestamps for each file on your system. These timestamps enable you to discover when was a file last updated. But what do they all mean? And how do you find out these times for a file? Is there a difference when it comes to directories?
An understanding of atime, ctime, and mtime can answer all of these questions. These are the three timestamps that Unix filesystems track. If you ever need to find out details about what changed and when, read on.
What Are the Three Unix Timestamps?
Each file has three timestamps associated with it. Linux stores these in the Unix time format which measures seconds since the epoch. The three timestamps are commonly referred to as atime, ctime, and mtime.
The mtime is the most common and often the most useful. It stands for modified time. It’s the time at which the file’s contents were last written to disk.
Slightly different is the ctime which stands for change time. This timestamp tracks metadata changes such as ownership and permissions. It includes renaming a file—at least, on typical modern Linux OSes. But it also updates when the file’s content changes, so it’s always as up-to-date as the mtime.
The third timestamp is the atime, which stores the last time anyone accessed the file.
How Timestamps Apply to Directories
A Linux directory is, essentially, a list of the files in that directory. So creating a file inside a directory will update that directory’s mtime. Listing the files in the directory, using the ls command, for example, updates its access time. And, as with a file, changing a directory’s permissions or name updates its ctime.
What About Creation Time?
It may surprise you to learn that Linux simply doesn’t keep track of creation time. You might initially assume that ctime stands for creation time. Equally, you might think of it as a very useful thing to be able to find out.
Many applications save files by creating them from scratch each time. This would make using a creation time misleading.
How to View the Different Timestamps
The simplest way to get timestamp information is with the ls command. The default long format shows details for the mtime:
$ date
Sat Mar 6 16:57:01 GMT 2021
$ echo "hello, world" > tmp
$ ls -l tmp.txt
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 16:57 tmp
You can display the atime instead by using the -u flag:
$ date
Sat Mar 6 16:59:33 GMT 2021
$ cat tmp
hello, world
$ ls -lu tmp
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 16:59 tmp
$ ls -l tmp
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 16:57 tmp
The last line confirms that the mtime of this file is different from the atime. Finally, use the -c flag to view ctime:
$ date
Sat Mar 6 17:02:34 GMT 2021
$ mv tmp tmp2
$ ls -lc tmp2
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 17:02 tmp2
$ ls -l tmp2
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 16:57 tmp2
$ ls -lu tmp2
-rw-r--r-- 1 ubuntu ubuntu 13 2021-03-06 16:59 tmp2
This time, we confirm that all three times are distinct and correct: we modified, then accessed, then changed the file, in that order.
An alternative to ls is the stat command. This command displays low-level details from the file’s inode. It makes it easier to check all three times at once. It also gets around the problem of the unintuitive -u flag. Here’s an example output for the same file:
$ stat tmp2
File: `tmp2'
Size: 13 Blocks: 8 IO Block: 4096 regular file
Device: 801h/2049d Inode: 327688 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ ubuntu) Gid: ( 1000/ ubuntu)
Access: 2021-03-06 16:59:45.000000000 +0000
Modify: 2021-03-06 16:57:59.000000000 +0000
Change: 2021-03-06 17:02:43.000000000 +0000
How to Update Timestamps
The touch command changes the modification and access times of a file. It’s also a convenient way of creating an empty file, which it will do if the file doesn’t already exist:
touch tmp
By default, it will set mtime and atime to the current time. You can set a different time with the -t flag:
touch -t 202103061200 tmp
You can also set only mtime or atime with the -m and -a flags respectively:
touch -t 202103061300 -m tmp
Note that the ctime always updates when we set the atime or mtime.
How to Find Files Based on Timestamps
The find command is another tool that acts on timestamps. It can filter files based on atime, ctime, or mtime. For example:
find . -amin 15
will find files accessed exactly 15 minutes ago, while:
find . -mtime -2
will find files modified within the last two days.
Linux Keeps Track of Every File Three Times
The most commonly referenced file timestamp is mtime. This is the date and time that a file listing shows, for example. But the other two timestamps can be useful as well, provided you understand what they’re referring to. In particular, always remember that ctime represents change time, not creation time.
Commands such as touch and stat are useful members of the Linux command line toolbox. These commands will enhance your Linux workflow by allowing you to create new files quickly.