How to check the modification and access time of a file in Linux

Introduction

In the Linux operating system, every file has associated timestamps that track when the file was modified, accessed, or had its attributes changed. Understanding these timestamps is essential for system administrators, developers, and regular users who need to monitor file activities.

This tutorial guides you through the practical techniques to check file timestamps in Linux. You will learn how to view modification and access times using different commands, helping you to better track changes and monitor file usage patterns in your Linux environment.

Understanding File Timestamps in Linux

In Linux, each file has three important timestamps that are automatically maintained by the system:

Types of File Timestamps

Modification Time (mtime): Records when the file's content was last modified.
Access Time (atime): Records when the file was last read or accessed.
Change Time (ctime): Records when the file's metadata (permissions, ownership) was last changed.

Let's start exploring file timestamps by creating a test file and examining its properties.

First, open the terminal and navigate to your project directory:

cd ~/project

Create a simple text file using the touch command:

touch testfile.txt

The touch command creates an empty file if it doesn't exist, or updates the timestamps if it already exists.

Let's check the basic file information using the ls command with the -l option (long listing format):

ls -l testfile.txt

You should see output similar to this:

-rw-r--r-- 1 labex labex 0 May 15 14:30 testfile.txt

In this output:

The first column shows the file permissions
The third and fourth columns show the owner and group
The fifth column shows the file size (0 bytes)
The date and time ("May 15 14:30" in this example) shows the modification time
The last column is the filename

This basic listing shows the modification time, but not the access time or change time. We'll explore those in the following steps.

Using the stat Command to View All Timestamps

While the ls command gives us basic file information, the stat command provides more detailed information about a file, including all three timestamps.

Let's use the stat command to view all timestamps for our test file:

stat testfile.txt

You should see output similar to this:

  File: testfile.txt
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:30:00.000000000 +0000
Modify: 2023-05-15 14:30:00.000000000 +0000
Change: 2023-05-15 14:30:00.000000000 +0000
 Birth: -

In this output:

Access: Shows when the file was last accessed (atime)
Modify: Shows when the file content was last modified (mtime)
Change: Shows when the file's metadata was last changed (ctime)
Birth: Shows the file creation time (not supported on all filesystems)

Notice that all three timestamps are currently the same because we just created the file. Let's modify the file to see how these timestamps change.

Add some content to the file using the echo command:

echo "This is a test file" > testfile.txt

Now let's check the timestamps again:

stat testfile.txt

You should see that the modification time (Modify) and change time (Change) have been updated, while the access time might remain the same depending on your system configuration.

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:30:00.000000000 +0000
Modify: 2023-05-15 14:35:12.000000000 +0000
Change: 2023-05-15 14:35:12.000000000 +0000
 Birth: -

Checking Modification Time (mtime)

The modification time (mtime) is updated whenever the content of a file changes. This is the timestamp most commonly displayed by default in file listings.

Using ls to Check Modification Time

The standard ls -l command shows the modification time by default:

ls -l testfile.txt

Output:

-rw-r--r-- 1 labex labex 19 May 15 14:35 testfile.txt

For files modified in the current year, ls -l shows the month, day, and time. For files modified in previous years, it shows the month, day, and year instead of the time.

Customizing the Time Format

To see more detailed timestamp information, use the --time-style option with ls:

ls -l --time-style=full-iso testfile.txt

Output:

-rw-r--r-- 1 labex labex 19 2023-05-15 14:35:12.000000000 +0000 testfile.txt

This shows the full ISO format timestamp, including year, month, day, hours, minutes, seconds, and timezone.

You can also use other format options like long-iso or iso:

ls -l --time-style=long-iso testfile.txt

Output:

-rw-r--r-- 1 labex labex 19 2023-05-15 14:35 testfile.txt

Using date to Display Modification Time

Another way to check the modification time is with the date command using the -r option:

date -r testfile.txt

Output:

Mon May 15 14:35:12 UTC 2023

This command displays the modification time in a human-readable format.

Checking Access Time (atime)

The access time (atime) is updated whenever a file is read or accessed. However, many modern Linux systems use mount options like relatime or noatime to reduce the frequency of atime updates for better performance.

Using ls to Check Access Time

To view the access time instead of the modification time, use the -u option with ls -l:

ls -lu testfile.txt

Output:

-rw-r--r-- 1 labex labex 19 May 15 14:40 testfile.txt

The timestamp shown is now the access time instead of the modification time.

Let's access the file to update its access time:

cat testfile.txt

Output:

This is a test file

Now check the access time again:

ls -lu testfile.txt

You should see that the access time has been updated to the current time.

Comparing All Timestamps

Let's use the stat command to see all timestamps after accessing the file:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:41:05.000000000 +0000
Modify: 2023-05-15 14:35:12.000000000 +0000
Change: 2023-05-15 14:35:12.000000000 +0000
 Birth: -

Notice that only the access time has changed, while the modification time and change time remain the same as before.

Changing File Permissions to Update Change Time

Let's update the change time (ctime) by modifying the file's permissions:

chmod 640 testfile.txt

Check all timestamps again:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0640/-rw-r-----)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:41:05.000000000 +0000
Modify: 2023-05-15 14:35:12.000000000 +0000
Change: 2023-05-15 14:42:30.000000000 +0000
 Birth: -

You can see that the change time (ctime) has been updated to the current time, while the access time and modification time remain unchanged.

Manipulating File Timestamps with touch

The touch command allows you to not only create files but also update their timestamps. This is useful for testing or when you need to synchronize timestamps between files.

Updating All Timestamps

To update all timestamps (access, modification, and change) to the current time:

touch testfile.txt

Check the timestamps:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0640/-rw-r-----)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:45:10.000000000 +0000
Modify: 2023-05-15 14:45:10.000000000 +0000
Change: 2023-05-15 14:45:10.000000000 +0000
 Birth: -

Updating Only Access Time

To update only the access time:

touch -a testfile.txt

Check the timestamps:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0640/-rw-r-----)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:46:15.000000000 +0000
Modify: 2023-05-15 14:45:10.000000000 +0000
Change: 2023-05-15 14:46:15.000000000 +0000
 Birth: -

Note that the change time (ctime) is also updated because the file's metadata has changed.

Updating Only Modification Time

To update only the modification time:

touch -m testfile.txt

Check the timestamps:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0640/-rw-r-----)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-05-15 14:46:15.000000000 +0000
Modify: 2023-05-15 14:47:20.000000000 +0000
Change: 2023-05-15 14:47:20.000000000 +0000
 Birth: -

Again, the change time is also updated.

Setting Specific Timestamps

You can set a specific timestamp using the -d option with touch:

touch -d "2023-01-01 12:00:00" testfile.txt

Check the timestamps:

stat testfile.txt

Output:

  File: testfile.txt
  Size: 19          Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d  Inode: 2101099     Links: 1
Access: (0640/-rw-r-----)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-01-01 12:00:00.000000000 +0000
Modify: 2023-01-01 12:00:00.000000000 +0000
Change: 2023-05-15 14:48:30.000000000 +0000
 Birth: -

This sets both the access and modification times to January 1, 2023, at 12:00 PM. The change time is still updated to the current time.

Creating a New File with Timestamps from an Existing File

You can also use the -r option to reference another file's timestamps:

## Create a new file
touch newfile.txt

## Set its timestamps based on testfile.txt
touch -r testfile.txt newfile.txt

Check the timestamps of the new file:

stat newfile.txt

Output:

  File: newfile.txt
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 801h/2049d  Inode: 2101100     Links: 1
Access: (0644/-rw-r--r--)  Uid: (1000/labex)   Gid: (1000/labex)
Access: 2023-01-01 12:00:00.000000000 +0000
Modify: 2023-01-01 12:00:00.000000000 +0000
Change: 2023-05-15 14:49:45.000000000 +0000
 Birth: -

The access and modification times of newfile.txt now match those of testfile.txt.

Summary

In this lab, you have learned how to:

Understand the three types of file timestamps in Linux: modification time (mtime), access time (atime), and change time (ctime)
Use the ls command with various options to display file timestamps
Use the stat command to view detailed timestamp information
Read file contents to update access time
Change file permissions to update change time
Use the touch command to manually manipulate file timestamps
Apply specific timestamps to files
Copy timestamps from one file to another

These skills are essential for effective file management and monitoring in Linux. File timestamps help you track changes, monitor access patterns, and ensure files are being properly maintained. Whether you are a system administrator tracking unauthorized changes, a developer debugging file-related issues, or a regular user organizing your files, understanding file timestamps is a valuable skill in the Linux environment.