Home FAQ Linux File Timestamps Explained With Examples
Linux File Timestamps Explained With Examples

Linux File Timestamps Explained With Examples

By sk
642 Views

This tutorial explains the types of Linux file timestamps and how to view and change a file's timestamps using touch command with examples.

A brief introduction to Linux file timestamps

In Linux and Unix in general, every file has three types of timestamps namely atime (access time), mtime (modification time) and ctime (change time). As the name implies, the timestamps are used to find out when a file was accessed, modified and changed.

The access time (or atime in short) timestamp is the last time a file was read. For instance, you might have opened the file. The file may have been accessed by some other program or a remote machine. You might have read the contents of a file using a command (e.g. cat command), or a program (e.g. gedit, vim etc.). The file is neither edited nor modified. It has only been accessed by you or some other user from a remote system.

The modification time (or mtime) timestamp indicates the last time a file (or directory) was modified. In other words, mtime indicates the time the contents of a file has been changed. For instance, you might have added something in the file or deleted something from the file, or might have amended the contents of the file.

A change time (or ctime) timestamp shows the last time the file contents or the file metadata (i.e. file attributes, such as file ownership, file permissions, or group) was changed.

In summary,

  • atime - indicates the the time of last access to file for reading contents.
  • mtime - indicates the time of last modification to file contents.
  • ctime - indicates the time of last change to file contents or file metadata (owner, group, or permissions).

The timestamps can be helpful in various situations. Here are a few use-cases for timestamps:

View Linux file timestamps with stat and ls commands

We can view the file timestamps in Linux using stat command. According to man pages, the stat command displays file or file system status in Linux. The stat command is part of the GNU Coreutils, so let's not bother installing it.

Now, let us check the timestamps of a text file named ostechnix.txt using stat command:

$ stat ostechnix.txt

Sample output:

  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:31:01.484504149 +0530
Modify: 2020-11-11 17:31:01.484504149 +0530
Change: 2020-11-11 17:31:01.484504149 +0530
 Birth: -
View Linux file timestamps with stat command
View Linux file timestamps with stat command

The last three lines in the above output shows the access time, modification time and change time timestamps respectively. When we just create a new file, all timestamps are same.

Did you notice line "Birth:" at the end of the output? It indicates the file creation time timestamp. The POSIX standard does not define a timestamp for file creation. Some filesystems (e.g. ext4, JFS, Btrfs) store this value, but currently there is no Linux kernel API to access it. So, we see a hyphen "-" instead of a timestamp in "Birth:" line.

You can also get the atime, mtime, and ctime timestamps individually using ls command.

To view the modification time (mtime) timestamp, use ls -l command:

$ ls -l ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

To view the change time (ctime) timestamp, run ls -lc command:

$ ls -lc ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

Here, the c flag is used to display the time of last change to file metadata or file attributes.

View access time (atime) timestamp with ls -lu command:

$ ls -lu ostechnix.txt 
-rw-rw-r-- 1 sk sk 21 Nov 11 17:31 ostechnix.txt

Here, the u flag displays the time of last access to the file.

View Linux file timestamps with ls command
View Linux file timestamps with ls command

Change Linux file timestamps with touch command

The touch command is used to change the file timestamps as well as create new, empty files in Linux. Just like stat command, the touch command is also part of GNU coreutils, so you don't need to install it either.

Before changing the timestamps, let us get the current timestamps of the file named ostechnix.txt for reference:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:31:01.484504149 +0530
Modify: 2020-11-11 17:31:01.484504149 +0530
Change: 2020-11-11 17:31:01.484504149 +0530
 Birth: -

As you can see in the above output, the file ostechnix.txt was accessed. modified and changed on the same date and time i.e. November 11, 2020 at 17:31:01.

Let us change the timestamps of this file using touch command like below:

$ touch ostechnix.txt

The above command will change all timestamps (i.e. atime, mtime and ctime) to your computer's current time.

Now let us take a look at the timestamps of the file with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:39:59.430610787 +0530
Modify: 2020-11-11 17:39:59.430610787 +0530
Change: 2020-11-11 17:39:59.430610787 +0530
 Birth: -
Change Linux file timestamps using touch command
Change Linux file timestamps using touch command

See? All timestamps have been changed to my system's current time i.e. 2020-11-10 17:51:02.

It is also possible to change individual timestamps separately. For instance, you can change only the access time (atime) timestamp with -a flag:

$ touch -a ostechnix.txt

The above command will set the access time timestamp to the current time.

Now, check the timestamp of ostechnix.txt file with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:43:46.555428706 +0530
Modify: 2020-11-11 17:39:59.430610787 +0530
Change: 2020-11-11 17:43:46.555428706 +0530
 Birth: -
Change only the access time timestamp with touch command
Change only the access time timestamp with touch command

As you see in the above output, the access time is changed to current time. The change time is also updated.

To change only the modification time timestamp (mtime), use -m flag:

$ touch -m ostechnix.txt

Verify if the mtime has changed with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:43:46.555428706 +0530
Modify: 2020-11-11 17:47:17.577722187 +0530
Change: 2020-11-11 17:47:17.577722187 +0530
 Birth: -
Change only the modification time timestamp with touch command
Change only the modification time timestamp with touch command

Now the mtime and ctime timestamps changed while atime remained as it is.

As you might have noticed when we change the access time or modification time, the ctime also gets updated.

If you want to change both atime and mtime timestamps simultaneously, use -d option.

$ touch -d "2020-11-11 17:50:01" ostechnix.txt

Verify if the atime and mtime timestamps have been changed or not with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:50:01.000000000 +0530
Modify: 2020-11-11 17:50:01.000000000 +0530
Change: 2020-11-11 17:51:17.024213698 +0530
 Birth: -
Change both atime and mtime timestamps simultaneously with touch command
Change both atime and mtime timestamps simultaneously with touch command

We have now set the access time and modification time to a specific time i.e. 2020-11-11 17:50:01. And the ctime timestamp was also updated to the current time.

It is also possible to use specific timestamp instead of current time with -t flag as well:

$ touch -t 2011111754 ostechnix.txt

This command will set the atime and mtime timestamps to 2020-11-11 17:54:00. Verify it with stat command like below:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:54:00.000000000 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:56:20.844405239 +0530
 Birth: -

As stated already, the ctime gets updated when the atime and mtime are changed. If you want to change only the ctime timestamp, there is no dedicated flag in touch command. So you need to manually change the ctime by modifying the file metadata or file attributes. For example, I am going to assign executable permission to ostchnix.txt file with chmod command:

$ chmod +x ostechnix.txt

Check if ctime gets update with stat command:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 17:54:00.000000000 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:57:21.022720776 +0530
 Birth: -
Change only the change time timestamp with touch command
Change only the change time timestamp with touch command

See? The ctime timestamp changed but the atime and mtime times didn't. Because the file is neither accessed not changed. I changed the file permission only.

Change file timestamps by viewing or accessing or modifying files

As stated already, the atime timestamp gets changed when we access the file for read. Try to access the file for read using cat command and see what happens.

$ cat ostechnix.txt
This is a text file.

Now check if the access time timestamp is updated:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 21        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 18:00:16.005323521 +0530
Modify: 2020-11-11 17:54:00.000000000 +0530
Change: 2020-11-11 17:57:21.022720776 +0530
 Birth: -

See? The atime value has changed now.

The mtime gets updated when we add or remove data from a file.

Let me add a line in the ostechnix.txt file:

$ echo "modify this file" >> ostechnix.txt

Check the file timestamps:

$ stat ostechnix.txt 
  File: ostechnix.txt
  Size: 38        	Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d	Inode: 4351679     Links: 1
Access: (0775/-rwxrwxr-x)  Uid: ( 1000/      sk)   Gid: ( 1000/      sk)
Access: 2020-11-11 18:00:16.005323521 +0530
Modify: 2020-11-11 18:01:49.072771458 +0530
Change: 2020-11-11 18:01:49.072771458 +0530
 Birth: -

Since the contents of the file changed, its mtime and ctime both changed.

Change symbolic link timestamps

By default, if you use touch command on a symbolic link (or symlink), it will change the timestamps of the referenced file as well.

If you want to only change the timestamp of a symlink, use -h, (--no-dereference) option:

$ touch -h <path-to-symlink>

[Bonus Tip] Copy timestamps from another file

The touch command has an option called -r, (--reference=) which allows you to copy timestamps from one file to another.

The following command will copy the timestamps of file1 to file2.

$ touch -r file1.txt file2.txt

For more details, refer man pages of stat and touch commands:

$ man stat
$ man touch

Conclusion

In this guide, we have discussed three types of Linux file timestamps i.e. atime, mtime and ctime, how to view the file timestamps using stat and ls commands and finally how to change those file timestamps with touch command. Hope this helps.

You May Also Like

2 comments

Bob November 12, 2020 - 2:38 am

Thanks for the helpful article.

I’m running Ubuntu 20.04. I take photos in a digital camera.
The date and time of the photo is shown correctly in the camera.
The EXIF data for the photo is shown correctly on both
computer and camera. However, when I run “stat” on the
file on the chip in my computer, the file dates are 3 months
AFTER the date of the photo. For instance, August 21 photo
is shown by “stat” as dated November 21 (yes, in the future).

Any thoughts?

Reply
sk November 12, 2020 - 11:22 am

That’s odd. I never had that issue. I don’t know any workaround for this problem. Sorry.

Reply

Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More