File Timestamps - mtime, ctime and atime in Linux

Timestamps are records for the times in which actions are performed on files. A timestamp is useful because it keeps records of when a file was accessed, modified, or added. Linux's files have 3 timestamps recorded by the computer: 

• Access timestamp (atime): which indicates the last time a file was accessed.
• Modified timestamp (mtime): which is the last time a file's contents were modified.
• Change timestamp (ctime): which refers to the last time some metadata related to the file was changed.

In Linux, a timestamp is actually stored as a number of seconds instead of a date and time. This number of seconds refers to the amount of time since 00:00:00 on January 1, 1970, which is the time of Unix Epoch. However, when a user wants a timestamp to be displayed, Linux will translate it to a human-readable format, so it is displayed as a date and time. Users can view timestamps using ls command or stat command.

mtime:

Modified timestamp (mtime) indicates the last time the contents of a file were modified. For example, if new contents were added, deleted, or replaced in a file, the modified timestamp is changed. To view the modified timestamp, we can simple use the ls command with -l option.

Syntax:
ls -l [filename]

ctime:

Unlike mtime, which is only related to the contents inside a file, changed timestamp indicates the last time some metadata of a file was changed. ctime refers to the last time when a file’s metadata. For example, if permission settings of a file were modified, ctime will indicate it. To see the changed timestamp, we can use -lc option with the ls command as follows:

Syntax:
ls -lc [filename]

atime:

Access timestamp (atime) refers to the last time a file was read by a user. That is, a user displayed the contents of a file using any suitable program, but did not necessarily modify anything. To view an access timestamp using ls command, we use -lu option followed by the file name.

Syntax:
ls -lu [filename]

stat command:

stat command can be used to see all timestamps of a file simultaneously.

Syntax:
stat [filename]

Comparison Table

The table below summarizes the difference between the three timestamps we mentioned:

To further explain the concept, we will examine a file named test.txt, the following changes were made to the file:

Creating the File

The file was created at 14:04 on 25/03/2021 using the nano command. We can also use the touch command or any text editor. Initially, we added 1 line to the file

Command to create file:

nano test.txt

Initially, the timestamps all show the time in which the file was created. The image below shows an example of using the stat command to view the 3 timestamps. In this image, the initial timestamps, which show the time that the file was created, are shown. The number +004 at the right of each timestamp is known as time zone offset, which indicates that the time zone is +004 hours ahead of UTC. The displayed date and time are converted from UTC to the local time zone when displayed to the user. We can also notice that stat command is highly exact in showing the seconds in a timestamp.

Command:

stat test.txt

Alternatively, ls command can be used to view each timestamp individually as follows:

Command:

mtime: ls -l test.txt
ctime: ls -cl test.txt
atime: ls -ul test.txt

In the following steps, we will make some changes in the file and observe the change in timestamps using stat command. ls command can be used as well.

Modifying the File

The file was accessed and a new line was added to it at 14:22 on 25/03/2021 using nano text editor (any text editor can be used).

Command:

nano test.txt

Using stat command, we can see that all 3 timestamps were changed to 14:22. 

Command:

stat test.txt

Changing Metadata

The file's permissions were changed at 14:36 on 25/3/2021 using chmod command.

Command:

chmod 777 test.txt

We notice that after changing the permissions, both ctime and atime changed to 14:36. This is not the case with mtime since it only changes when the contents inside the file are modified. Therefore, mtime is still at 14:22.

Command:

stat test.txt

Opening the File without Making Changes

The file was opened in nano text editor, but no changes were made at 14:55 on 25/3/2021.

Command:

nano test.txt

From the output of stat command, we can observe that the only timestamp that changed to 14:55 is the access timestamp. This is because no data was changed. Therefore, ctime remains at 14:36 while mtime remains at 14:22.

Command:

stat test.txt