atime, mtime and ctime : Concepts & Practical examples

Introduction

time

Unix and therefore Linux uses (at least) 3 different timestamps on modern file systems (see File systems Table for info) in order to date any files. You can use these information to search for files, check logs, manage your backup and more… that’s why it is a must  for any sysadmin to clearly understand this mechanism.

This page is aimed at exposing basics knowledge to understand and use files timestamps.

1) Definitions

Here are some time stamps related definitions.

1.1 atime

This is the Access time :
atime is updated whenever file’s data is accessed (a read, write or any other access); this could be done by a system process, interactively by CLI or by a script.

1.2 mtime

This is the Modification time :
mtime is updated whenever the file’s content changes. This time stamp is not updated by a change of files permissions (e.g : through a chown command). It is usually used for tracking the file content changes (see the Linux time related tools section below for more infos).

mtime changing implies a ctime change too.

So basically mtime represents the file’s data age.

1.3 ctime

This is the Change time :
ctime is updated when  file’s ownership, access permissions or file contents are modified. As stated in ls manual (man ls) : time of last modification of file status information. ctime is updated when the inode data changes.

 

 

2) File Systems and time stamping

The following table is a quick summary of commons file systems time stamping properties.

File Systems and Time stamping
FileSystems atime ctime mtime Creation time
ext2 yes yes yes no
ext3 yes yes yes no
ext4 yes yes yes yes
btrfs yes yes yes yes
reiserfs yes yes yes no
zfs yes yes yes yes
ntfs yes yes yes yes

 

 

3) Practical examples

This section propose some practical examples related to the Unix/Linux files timestamps. These examples are based on common Linux commands and show their effects on timestamps.

Which time stamp is updated when ….

3.1 Moving a file with mv

atime : not updated

mtime : not updated

ctime : UPDATED

  • Example
    bash-3.2$ touch moved.txt      # Creating the test file
    bash-3.2$ stat moved.txt       # Checking its stats
    File: `moved.txt'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234806     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:09:02.000000000 +0200   # This is atime
    Modify: 2012-08-16 17:09:02.000000000 +0200   # This is mtime
    Change: 2012-08-16 17:09:02.000000000 +0200   # This is ctime
    bash-3.2$ mv moved.txt moved.txt_moved        # moving the test file with mv command
    bash-3.2$ stat moved.txt_moved                # Checking test file again to see the changes
    File: `moved.txt_moved'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234806     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:09:02.000000000 +0200
    Modify: 2012-08-16 17:09:02.000000000 +0200
    Change: 2012-08-16 17:10:07.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with mv command

 

 

3.2 Copying a file with cp

atime : UPDATED

mtime : not updated

ctimenot updated

  • Example
    bash-3.2$ touch copied.txt   # Creating test file
    bash-3.2$ stat copied.txt    # Checking test file stats
    File: `copied.txt'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234808     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:38:09.000000000 +0200   # This is atime
    Modify: 2012-08-16 17:38:09.000000000 +0200   # This is mtime
    Change: 2012-08-16 17:38:09.000000000 +0200   # This is ctime
    bash-3.2$ cp copied.txt copied.txt_copied     # copying test file using cp command
    bash-3.2$ stat copied.txt                     # Checking new file stats
    File: `copied.txt'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234808     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:39:03.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with cp command
    Modify: 2012-08-16 17:38:09.000000000 +0200
    Change: 2012-08-16 17:38:09.000000000 +0200

 

 

3.3 Updating a file timestamps with touch

atime : UPDATED

mtime : UPDATED

ctime : UPDATED

  • Example
    bash-3.2$ touch touch.txt   # Creating test file
    bash-3.2$ stat touch.txt    # Checking test file stats
    File: `touch.txt'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234810     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:38:09.000000000 +0200   # This is atime
    Modify: 2012-08-16 17:38:09.000000000 +0200   # This is mtime
    Change: 2012-08-16 17:38:09.000000000 +0200   # This is ctime
    bash-3.2$ touch touch.txt                     # updating test file using touch command
    bash-3.2$ stat touch.txt                     # Checking new file stats
    File: `touch.txt'
    Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234810     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command
    Modify: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command
    Change: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command

 

 

3.4 Updating a file content with a redirection

atimenot updated

mtime : UPDATED

ctime : UPDATED

  •  Example
    bash-3.2$ touch redirection.txt
    bash-3.2$ stat redirection.txt
      File: `redirection.txt'
      Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234811     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:58:55.000000000 +0200
    Modify: 2012-08-16 17:58:55.000000000 +0200
    Change: 2012-08-16 17:58:55.000000000 +0200
    bash-3.2$ echo "redirection test" > redirection.txt   # First test : replacing test file content
    bash-3.2$ stat redirection.txt
      File: `redirection.txt'
      Size: 17              Blocks: 8          IO Block: 4096   fichier régulier
    Device: 806h/2054d      Inode: 4234811     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:58:55.000000000 +0200
    Modify: 2012-08-16 17:59:18.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with a simple redirection
    Change: 2012-08-16 17:59:18.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with a simple redirection
    bash-3.2$ echo "redirection test APPEND" >> redirection.txt
    bash-3.2$ stat redirection.txt
      File: `redirection.txt'
      Size: 41              Blocks: 8          IO Block: 4096   fichier régulier
    Device: 806h/2054d      Inode: 4234811     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-16 17:58:55.000000000 +0200
    Modify: 2012-08-16 18:00:01.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with an "APPENDED" redirection : exactly the same as for a simple redirect.
    Change: 2012-08-16 18:00:01.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with an "APPENDED" redirection : exactly the same as for a simple redirect.

 

3.5 Changing the file owner

atimenot updated

mtimenot updated

ctime : UPDATED

 

  • Example
    bash-3.2$ touch chown.txt
    bash-3.2$ stat chown.txt
      File: `chown.txt'
      Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234946     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-17 14:09:22.000000000 +0200
    Modify: 2012-08-17 14:09:22.000000000 +0200
    Change: 2012-08-17 14:09:22.000000000 +0200
    bash-3.2$ su -c "chown root:root chown.txt"   # chown-ing the test file
    Mot de passe :
    bash-3.2$ stat chown.txt
      File: `chown.txt'
      Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234946     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
    Access: 2012-08-17 14:09:22.000000000 +0200
    Modify: 2012-08-17 14:09:22.000000000 +0200
    Change: 2012-08-17 14:09:33.000000000 +0200    # THIS IS THE ONLY CHANGES THAT OCCURS with chown command
    
    bash-3.2$ touch chmod.txt
    bash-3.2$ stat chmod.txt
      File: `chmod.txt'
      Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234958     Links: 1
    Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-17 14:47:16.000000000 +0200
    Modify: 2012-08-17 14:47:16.000000000 +0200
    Change: 2012-08-17 14:47:16.000000000 +0200
    bash-3.2$ su -c "chmod 777 chmod.txt"
    Mot de passe :
    bash-3.2$ stat chmod.txt
      File: `chmod.txt'
      Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
    Device: 806h/2054d      Inode: 4234958     Links: 1
    Access: (0777/-rwxrwxrwx)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
    Access: 2012-08-17 14:47:16.000000000 +0200
    Modify: 2012-08-17 14:47:16.000000000 +0200
    Change: 2012-08-17 14:48:05.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with chmod command

 

 

 

4) Linux timestamps related tools

This chapter presents the most commons tools that can be used to check or update files timestamps.

4.1 ls

The ls command can be used to print and/or sort files by any of the three timestamps (atime, mtime, ctime).

4.1.1 Print and/or sort files by mtime

To print the mtime :

bash-3.2$ ls -l

Note : By default ls used with the “-l” option displays the mtime.

To print AND sort files by mtime, you just need to add the “-t” option as :

bash-3.2$ ls -lt

 

4.1.2 Print and/or sort files by ctime

To print the ctime :

bash-3.2$ ls -lc

To print AND sort files by ctime, you just need to add the “-t” option as :

bash-3.2$ ls -ltc

 

4.1.3 Print and/or sort files by atime

To print the atime :

bash-3.2$ ls -lu

To print AND sort files by atime, you just need to add the “-t” option as :

bash-3.2$ ls -ltu

 

4.2 find

Find is a powerful tool, i am sure you already know it (check this page for more examples), it can easily be used to found files according to timestamps parameters, here are some examples.

Find provides basically two different way for searching files according to their timestamps : it can search for files newer or older to another file and it can also search for files newer or older than a given date.

 

4.2.1 find files newer or older than another file

When find is searching for files (let’s call it the “evaluated file“) newer or older than a given file (let’s call this later file the “reference file“) it compares the evaluated file atime or ctime to the reference file mtime.

You can perform this kind of search using this form :

find -xnewer file

Where x can be :

  • “a” : to compare the “evaluated file” access time to the “reference file” mtime
    • Example :
      find /etc -anewer reference_file.txt
  • “c” : to compare the “evaluated file” change time to the “reference file” mtime
    • Example :
      find /etc -cnewer reference_file.txt

 

4.2.2 find files newer or older than a given date

When find is searching for files (the “evaluated file“) newer or older than a given date, it compares the evaluated file atime or ctime to the given date.

You can perform this kind of search using one of these forms :

find -xtime n    # Where n is a number of days
find -xmin n     # Where n is a number of minutes

Note : You can specify an operator to the “n” number as : “+” or “-“. A “+” sign means greater than “n“, “-” sign means lesser than “n“. When no operator is given this means exactly “n“.

Where x can be :

  • “a” : to compare the “evaluated file” access time to “n” (where “n” can be a number of days or minutes)
    • Examples :
      find /etc -atime -30    # This would search for files with a last access time (atime) newer than 30 days (that occurs within the last 30 days)
      find /etc -atime +30    # This would search for files with a last access time (atime) older than 30 days
      find /etc -amin -60     # This would search for files with a last access time (atime) newer than 60 minutes (that occurs within the last 60 minutes)
      find /etc -amin +60     # This would search for files with a last access time (atime) older than 60 minutes
  • “c” : to compare the “evaluated file” change time to “n” (where “n” can be a number of days or minutes)
    • Examples :
      find /etc -ctime -40    # This would search for files with a last change time (ctime) newer than 40 days (that occurs within the last 40 days)
      find /etc -ctime +40    # This would search for files with a last change time (ctime) older than 40 days
      find /etc -cmin -50     # This would search for files with a last change time (ctime) newer than 50 minutes (that occurs within the last 50 minutes)
      find /etc -cmin +50     # This would search for files with a last change time (ctime) older than 50 minutes

 

Note : When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1,  a file has to have been accessed at least two days ago.

The -daystart option can be used to change this behaviour (see man find for more info)

4.2.3 Find files according to their mtime

TODO

4.2.4 Find files according to their ctime

TODO

4.2.5 Find files according to their atime

TODO

 

4.3 touch

The touch command allow you to modify the mtime, ctime and the atime stamps.

4.3.1 Change the three timestamps to the current timestamps

To change all three timestamps at once you should use the touch command with no options, as :

touch file
  • Example
    bash-3.2$ stat new.txt
      File: « new.txt »
      Size: 0               Blocks: 0          IO Block: 4096   fichier vide
    Device: 811h/2065d      Inode: 12716711    Links: 1
    Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
    Access: 2012-08-17 20:15:50.364731820 +0200
    Modify: 2012-08-17 20:15:50.364731820 +0200
    Change: 2012-08-17 20:15:50.364731820 +0200
    bash-3.2$ touch new.txt
    bash-3.2$ stat new.txt
      File: « new.txt »
      Size: 0               Blocks: 0          IO Block: 4096   fichier vide
    Device: 811h/2065d      Inode: 12716711    Links: 1
    Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
    Access: 2012-08-17 20:38:16.810732399 +0200
    Modify: 2012-08-17 20:38:16.810732399 +0200
    Change: 2012-08-17 20:38:16.810732399 +0200

 

 

4.3.2 Change the mtime timestamp to a given date

To do that change the mtime use this syntax :

touch -m [[CC]YY]MMDDhhmm[.ss]

Where :

  • CC : is the century (!?)
  • YY : is the year (e.g 89 for year 1989)
  • MM : is the month (e.g 09 for September)
  • DD : is the day (e.g
  • hh :
  • mm :
  • ss :

 

  • Example
    $ touch -m 200012311800 employees.txt

 

4.3.3 Change the atime timestamp to a given date

To do that change the atime use this syntax :

touch -a [[CC]YY]MMDDhhmm[.ss]

Where :

  • CC : is the century (!?)
  • YY : is the year (e.g 89 for year 1989)
  • MM : is the month (e.g 09 for September)
  • DD : is the day (e.g
  • hh :
  • mm :
  • ss :

 

4.4 stat

stat displays informations (statistics) of a file.

 

Resources

Leave a Reply

Your email address will not be published. Required fields are marked *

This site supports SyntaxHighlighter via WP SyntaxHighlighter. It can highlight your code.
How to highlight your code: Paste your code in the comment form, select it and then click the language link button below. This will wrap your code in a <pre> tag and format it when submitted.