File Timestamps - mtime, ctime and atime in Linux

file timestamps in linux

When you are working with directory and files, you may need to know about Linux file timestamps such as change time (ctime), access time (atime), and modification time (mtime).  Linux files, directories, sockets have three different timestamps – mtime, ctime and atime.

Probably when working in Linux you have get answers to following questions:

When was the last date of file content modified? When was the file last opened/accessed ? When the properties of the file such as ownership, permissions last changed?

Read Also: Linux Find Files Modified in Last Number of Days

Here, we are going to explain each file timestamps in Linux in detail.

mtime – Last modification time

Mtime or modification time is the time of the last change to the file contents. 'Modification' means something inside the file was amended or deleted, or new data was added.

Use the -l (long listing) option with ls, you can see the modified timestamp.

Output of ls -l

ctime – last change time

Ctime is the changed timestamp referring to changes made to attribute of a file such as ownership, access permission.  It’s the time at which the metadata related to the file changed.

To see the change timestamp, use the -lc option:-

Output of ls -lc

atime – last access time

Atime or access timestamp is the last time a file was read, read by one of the processes directly or through commands and scripts.

Use the -lu (access time) option with command ls to see access time. You can see the modification time and access time for the same file are different.

Output of ls -lu

Show mtime, atime and ctime with stat command

Most of the linux distribution come with stat command which can be used to show all of the time stamp in a more convenient way.

To see modification time, access time and change time of a particular file use as follow:-

Output of stat command

The timestamp are first generated in number of seconds since the Unix epoch, it translates the number of seconds into a date and time from the system time zone.  

Conclusion

Unfortunately, we won’t be able to find file creation time using ctime, atime or mtime orelse we have to use debugfs command.

In this article, we learned about Linux file timestamps and about access time, modification time, and change time. Your feedback is much welcome.

Pratik Gautam 1:05 pm

Comments

Your email address will not be published. Required fields are marked *

2 Comments

  1. > we won’t be able to find file creation time
    Maybe this is a minor weakness/failure with Linux. I believe Windows reports file creation time. I did "man debugfs" and did not see how I could use this command to get to know the creation time of files.