Skip to content
Related Articles

Related Articles

File Timestamps – mtime, ctime and atime in Linux
  • Last Updated : 09 Apr, 2021

Timestamps are records for the times in which actions are performed on files. A timestamp is useful because it keeps records of when a file was accessed, modified, or added. Linux’s files have 3 timestamps recorded by the computer: 

  • Access timestamp (atime): which indicates the last time a file was accessed.
  • Modified timestamp (mtime): which is the last time a file’s contents were modified.
  • Change timestamp (ctime): which refers to the last time some metadata related to the file was changed.

In Linux, a timestamp is actually stored as a number of seconds instead of a date and time. This number of seconds refers to the amount of time since 00:00:00 on January 1, 1970, which is the time of Unix Epoch. However, when a user wants a timestamp to be displayed, Linux will translate it to a human-readable format, so it is displayed as a date and time. Users can view timestamps using ls command or stat command.

mtime:

Modified timestamp (mtime) indicates the last time the contents of a file were modified. For example, if new contents were added, deleted, or replaced in a file, the modified timestamp is changed. To view the modified timestamp, we can simple use the ls command with -l option.

Syntax:
ls -l [filename]

ctime:

Unlike mtime, which is only related to the contents inside a file, changed timestamp indicates the last time some metadata of a file was changed. For example, if permission settings of a file were modified, mtime will indicate it. To see the changed timestamp, we can use -lc option with the ls command as follows:

Syntax:
ls -lc [filename]

atime:

Acces timestamp (atime) refers to the last time a file was read by a user. That is, a user displayed the contents of a file using any suitable program, but did not necessarily modify anything. To view an access timestamp using ls command, we use -lu option followed by the file name.



Syntax:
ls -lu [filename]

stat command:

stat command can be used to see all timestamps of a file simultaneously.

Syntax:
stat [filename]

Comparison Table

The table below summarizes the difference between the three timestamps we mentioned:

 File Contents are ModifiedMetadata is Modified File Accessed without ModificationCommand to Use
mtimeChangesNo changeNo changels -l or stat
ctimeChangesChangesNo changels -cl or stat
atimeChangesNo changeChangesls -ul or stat

To further explain the concept, we will examine a file named test.txt, the following changes were made to the file:

Creating the File

The file was created at 14:04 on 25/03/2021 using the nano command. We can also use the touch command or any text editor. Initially, we added 1 line to the file

Command to create file:

nano test.txt

File Timestamps - mtime, ctime and atime in Linux

Initially, the timestamps all show the time in which the file was created. The image below shows an example of using the stat command to view the 3 timestamps. In this image, the initial timestamps, which show the time that the file was created, are shown. The number +004 at the right of each timestamp is known as time zone offset, which indicates that the time zone is +004 hours ahead of UTC. The displayed date and time are converted from UTC to the local time zone when displayed to the user. We can also notice that stat command is highly exact in showing the seconds in a timestamp.

Command:



stat test.txt

File Timestamps - mtime, ctime and atime in Linux

Alternatively, ls command can be used to view each timestamp individually as follows:

Command:

mtime: ls -l test.txt
ctime: ls -cl test.txt
atime: ls -ul test.txt

In the following steps, we will make some changes in the file and observe the change in timestamps using stat command. ls command can be used as well.

Modifying the File

The file was accessed and a new line was added to it at 14:22 on 25/03/2021 using nano text editor (any text editor can be used).

Command:

nano test.txt

File Timestamps - mtime, ctime and atime in Linux

Using stat command, we can see that all 3 timestamps were changed to 14:22. 

Command:

stat test.txt

File Timestamps - mtime, ctime and atime in Linux

Changing Metadata

The file’s permissions were changed at 14:36 on 25/3/2021 using chmod command.

Command:

chmod 777 test.txt

We notice that after changing the permissions, both ctime and atime changed to 14:36. This is not the case with mtime since it only changes when the contents inside the file are modified. Therefore, mtime is still at 14:22.

Command:

stat test.txt

File Timestamps - mtime, ctime and atime in Linux

Opening the File without Making Changes

The file was opened in nano text editor, but no changes were made at 14:55 on 25/3/2021.

Command:

nano test.txt

From the output of stat command, we can observe that the only timestamp that changed to 14:55 is the access timestamp. This is because no data was changed. Therefore, ctime remains at 14:36 while mtime remains at 14:22.

Command:

stat test.txt

File Timestamps - mtime, ctime and atime in Linux

 

My Personal Notes arrow_drop_up
Recommended Articles
Page :