Linux File Timestamps Explained With Examples

This tutorial explains the types of Linux file timestamps and how to view and change a file's timestamps using touch command in Linux with examples.

A brief introduction to Linux file timestamps

In Linux and Unix in general, every file has three types of timestamps namely atime (access time), mtime (modification time) and ctime (change time). As the name implies, the timestamps are used to find out when a file was accessed, modified and changed.

The access time (or atime in short) timestamp is the last time a file was read. For instance, you might have opened the file. The file may have been accessed by some other program or a remote machine. You might have read the contents of a file using a command (e.g. cat command), or a program (e.g. gedit, vim etc.). The file is neither edited nor modified. It has only been accessed by you or some other user from a remote system.

The modification time (or mtime) timestamp indicates the last time a file (or directory) was modified. In other words, mtime indicates the time the contents of a file has been changed. For instance, you might have added something in the file or deleted something from the file, or might have amended the contents of the file.

A change time (or ctime) timestamp shows the last time the file contents or the file metadata (i.e. file attributes, such as file ownership, file permissions, or group) was changed.

In summary,

• atime - indicates the the time of last access to file for reading contents.
• mtime - indicates the time of last modification to file contents.
• ctime - indicates the time of last change to file contents or file metadata (owner, group, or permissions).

The timestamps can be helpful in various situations. Here are a few use-cases for timestamps:

• Find and sort files based on access or modification time.
• Find and delete files older than X days. Useful to clean up old files in your hard drive.
• Check when was a configuration file was changed.
• Verify if a file was accessed.
• Verify if a directory was updated.
• Find files older or newer than X days.

View Linux file timestamps with stat and ls commands

We can view the file timestamps in Linux using stat command. According to man pages, the stat command displays file or file system status in Linux. The stat command is part of the GNU Coreutils, so let's not bother installing it.

Now, let us check the timestamps of a text file named ostechnix.txt using stat command:

$ stat ostechnix.txt

Sample output:

  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:31:01.484504149 +0530
Modify: 2020-11-11 17:31:01.484504149 +0530
Change: 2020-11-11 17:31:01.484504149 +0530
 Birth: -

The last three lines in the above output shows the access time, modification time and change time timestamps respectively. When we just create a new file, all timestamps are same.

Did you notice line "Birth:" at the end of the output? It indicates the file creation time timestamp. The POSIX standard does not define a timestamp for file creation. Some filesystems (e.g. ext4, JFS, Btrfs) store this value, but currently there is no Linux kernel API to access it. So, we see a hyphen "-" instead of a timestamp in "Birth:" line.

You can also get the atime, mtime, and ctime timestamps individually using ls command.

To view the modification time (mtime) timestamp, use ls -l command:

$ ls -l ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

To view the change time (ctime) timestamp, run ls -lc command:

$ ls -lc ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

Here, the c flag is used to display the time of last change to file metadata or file attributes.

View access time (atime) timestamp with ls -lu command:

$ ls -lu ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

Here, the u flag displays the time of last access to the file.

Change Linux file timestamps with touch command

The touch command is used to change the file timestamps as well as create new, empty files in Linux. Just like stat command, the touch command is also part of GNU coreutils, so you don't need to install it either.

Before changing the timestamps, let us get the current timestamps of the file named ostechnix.txt for reference:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:31:01.484504149 +0530
Modify: 2020-11-11 17:31:01.484504149 +0530
Change: 2020-11-11 17:31:01.484504149 +0530
 Birth: -

As you can see in the above output, the file ostechnix.txt was accessed. modified and changed on the same date and time i.e. November 11, 2020 at 17:31:01.

Let us change the timestamps of this file using touch command like below:

$ touch ostechnix.txt

The above command will change all timestamps (i.e. atime, mtime and ctime) to your computer's current time.

Now let us take a look at the timestamps of the file with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:39:59.430610787 +0530
Modify: 2020-11-11 17:39:59.430610787 +0530
Change: 2020-11-11 17:39:59.430610787 +0530
 Birth: -

See? All timestamps have been changed to my system's current time i.e. 2020-11-10 17:51:02.

It is also possible to change individual timestamps separately. For instance, you can change only the access time (atime) timestamp with -a flag:

$ touch -a ostechnix.txt

The above command will set the access time timestamp to the current time.

Now, check the timestamp of ostechnix.txt file with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:43:46.555428706 +0530
Modify: 2020-11-11 17:39:59.430610787 +0530
Change: 2020-11-11 17:43:46.555428706 +0530
 Birth: -

As you see in the above output, the access time is changed to current time. The change time is also updated.

To change only the modification time timestamp (mtime), use -m flag:

$ touch -m ostechnix.txt

Verify if the mtime has changed with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:43:46.555428706 +0530
Modify: 2020-11-11 17:47:17.577722187 +0530
Change: 2020-11-11 17:47:17.577722187 +0530
 Birth: -

Now the mtime and ctime timestamps changed while atime remained as it is.

As you might have noticed when we change the access time or modification time, the ctime also gets updated.

If you want to change both atime and mtime timestamps simultaneously, use -d option.

$ touch -d "2020-11-11 17:50:01" ostechnix.txt

Verify if the atime and mtime timestamps have been changed or not with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:50:01.000000000 +0530
Modify: 2020-11-11 17:50:01.000000000 +0530
Change: 2020-11-11 17:51:17.024213698 +0530
 Birth: -

We have now set the access time and modification time to a specific time i.e. 2020-11-11 17:50:01. And the ctime timestamp was also updated to the current time.

It is also possible to use specific timestamp instead of current time with -t flag as well:

$ touch -t 2011111754 ostechnix.txt

This command will set the atime and mtime timestamps to 2020-11-11 17:54:00. Verify it with stat command like below:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:54:00.000000000 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:56:20.844405239 +0530
 Birth: -

As stated already, the ctime gets updated when the atime and mtime are changed. If you want to change only the ctime timestamp, there is no dedicated flag in touch command. So you need to manually change the ctime by modifying the file metadata or file attributes. For example, I am going to assign executable permission to ostchnix.txt file with chmod command:

$ chmod +x ostechnix.txt

Check if ctime gets update with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:54:00.000000000 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:57:21.022720776 +0530
 Birth: -

See? The ctime timestamp changed but the atime and mtime times didn't. Because the file is neither accessed not changed. I changed the file permission only.

Change file timestamps by viewing or accessing or modifying files

As stated already, the atime timestamp gets changed when we access the file for read. Try to access the file for read using cat command and see what happens.

$ cat ostechnix.txt
This is a text file.

Now check if the access time timestamp is updated:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 18:00:16.005323521 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:57:21.022720776 +0530
 Birth: -

See? The atime value has changed now.

The mtime gets updated when we add or remove data from a file.

Let me add a line in the ostechnix.txt file:

$ echo "modify this file" >> ostechnix.txt

Check the file timestamps:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 38        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 18:00:16.005323521 +0530
Modify: 2020-11-11 18:01:49.072771458 +0530
Change: 2020-11-11 18:01:49.072771458 +0530
 Birth: -

Since the contents of the file changed, its mtime and ctime both changed.

Change symbolic link timestamps

By default, if you use touch command on a symbolic link (or symlink), it will change the timestamps of the referenced file as well.

If you want to only change the timestamp of a symlink, use -h, (--no-dereference) option:

$ touch -h <path-to-symlink>

[Bonus Tip] Copy timestamps from another file

The touch command has an option called -r, (--reference=) which allows you to copy timestamps from one file to another.

The following command will copy the timestamps of file1 to file2.

$ touch -r file1.txt file2.txt

For more details, refer man pages of stat and touch commands:

$ man stat

$ man touch

Conclusion

In this guide, we have discussed three types of Linux file timestamps i.e. atime, mtime and ctime, how to view the file timestamps using stat and ls commands and finally how to change those file timestamps with touch command in Linux. Hope this helps.