File Timestamps – mtime, ctime and atime in Linux
Timestamps are records for the times in which actions are performed on files. A timestamp is useful because it keeps records of when a file was accessed, modified, or added. Linux’s files have 3 timestamps recorded by the computer:
- Access timestamp (atime): which indicates the last time a file was accessed.
- Modified timestamp (mtime): which is the last time a file’s contents were modified.
- Change timestamp (ctime): which refers to the last time some metadata related to the file was changed.
In Linux, a timestamp is actually stored as a number of seconds instead of a date and time. This number of seconds refers to the amount of time since 00:00:00 on January 1, 1970, which is the time of Unix Epoch. However, when a user wants a timestamp to be displayed, Linux will translate it to a human-readable format, so it is displayed as a date and time. Users can view timestamps using ls command or stat command.
Modified timestamp (mtime) indicates the last time the contents of a file were modified. For example, if new contents were added, deleted, or replaced in a file, the modified timestamp is changed. To view the modified timestamp, we can simple use the ls command with -l option.
Syntax: ls -l [filename]
Unlike mtime, which is only related to the contents inside a file, changed timestamp indicates the last time some metadata of a file was changed. For example, if permission settings of a file were modified, mtime will indicate it. To see the changed timestamp, we can use -lc option with the ls command as follows:
Syntax: ls -lc [filename]
Acces timestamp (atime) refers to the last time a file was read by a user. That is, a user displayed the contents of a file using any suitable program, but did not necessarily modify anything. To view an access timestamp using ls command, we use -lu option followed by the file name.
Syntax: ls -lu [filename]
stat command can be used to see all timestamps of a file simultaneously.
Syntax: stat [filename]
The table below summarizes the difference between the three timestamps we mentioned:
File Contents are Modified Metadata is Modified File Accessed without Modification Command to Use mtime Changes No change No change ls -l or stat ctime Changes Changes No change ls -cl or stat atime Changes No change Changes ls -ul or stat
To further explain the concept, we will examine a file named test.txt, the following changes were made to the file:
Creating the File
The file was created at 14:04 on 25/03/2021 using the nano command. We can also use the touch command or any text editor. Initially, we added 1 line to the file
Command to create file:
Initially, the timestamps all show the time in which the file was created. The image below shows an example of using the stat command to view the 3 timestamps. In this image, the initial timestamps, which show the time that the file was created, are shown. The number +004 at the right of each timestamp is known as time zone offset, which indicates that the time zone is +004 hours ahead of UTC. The displayed date and time are converted from UTC to the local time zone when displayed to the user. We can also notice that stat command is highly exact in showing the seconds in a timestamp.
Alternatively, ls command can be used to view each timestamp individually as follows:
mtime: ls -l test.txt ctime: ls -cl test.txt atime: ls -ul test.txt
In the following steps, we will make some changes in the file and observe the change in timestamps using stat command. ls command can be used as well.
Modifying the File
The file was accessed and a new line was added to it at 14:22 on 25/03/2021 using nano text editor (any text editor can be used).
Using stat command, we can see that all 3 timestamps were changed to 14:22.
The file’s permissions were changed at 14:36 on 25/3/2021 using chmod command.
chmod 777 test.txt
We notice that after changing the permissions, both ctime and atime changed to 14:36. This is not the case with mtime since it only changes when the contents inside the file are modified. Therefore, mtime is still at 14:22.
Opening the File without Making Changes
The file was opened in nano text editor, but no changes were made at 14:55 on 25/3/2021.
From the output of stat command, we can observe that the only timestamp that changed to 14:55 is the access timestamp. This is because no data was changed. Therefore, ctime remains at 14:36 while mtime remains at 14:22.