timestamp, modification time, and created time of a file

I just know that ls -t and ls -f give different sorting of files and subdirectories under a directory.

  • What are the differences between timestamp, modification time, and created time of a file?
  • How to get and change these kinds of information by commands?
  • In terms of what kind of information do people say a file is “newer” than the other?
  • What kinds of information’s change will not make the
    file different?

For example, I saw someone wrote:

By default, the rsync program only looks to see if the files are different in size and timestamp. It doesn’t care which file is newer, if it is different, it gets overwritten. You can pass the ‘–update’ flag to rsync which will cause it to skip files on the destination if they are newer than the file on the source, but only so long as they are the same type of file. What this means is that if, for example, the source file is a regular file and the destination is a symlink, the destination file will be overwritten, regardless of timestamp.

On a side note, does the file type here mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

Asked By: Tim


There are 3 kind of “timestamps”:

  • Access – the last time the file was read
  • Modify – the last time the file was modified (content has been modified)
  • Change – the last time meta data of the file was changed (e.g. permissions)

To display this information, you can use stat which is part of the coreutils.

stat will show you also some more information like the device, inodes, links, etc.

Remember that this sort of information depends highly on the filesystem and mount options. For example if you mount a partition with the noatime option, no access information will be written.

A utility to change the timestamps would be touch.
There are some arguments to decide which timestamp to change (e.g. -a for access time, -m for modification time) and to influence the parsing of a new given timestamp.
See man touch for more details.

touch can become handy in combination with cp -u (“copy only when the SOURCE file is newer than the destination file or when the destination file is missing”) or for the creation of empty marker files.

Answered By: echox

The answer of echox is valid but I want to add information regarding file creation time.

File System Support

Some file systems support an additional entry in the inode regarding the creation time (or birth time). I know that ext4 supports this feature and also JFS and BTRFS.

However most tools and API have not yet been updated to read this extra information. So even-though it could be there, it’s not accessible.

For instance on Ubuntu 12.04 LTS I get the following for a file I created today:

$ echo Just another test > /tmp/mytest
$ sleep 3
$ touch /tmp/mytest
$ sleep 2
$ cat /tmp/mytest > /dev/null
$ stat /tmp/mytest 
Access: 2012-06-05 13:33:44.279774711 +0200
Modify: 2012-06-05 13:33:34.611893317 +0200
Change: 2012-06-05 13:33:34.611893317 +0200
 Birth: -
$ sudo debugfs -R 'stat /tmp/mytest' /dev/sda1
 ctime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
 atime: 0x4fcdee98:42b417dc -- Tue Jun  5 13:33:44 2012
 mtime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
crtime: 0x4fcdee46:01258f1c -- Tue Jun  5 13:32:22 2012

You can see that the newer stat function has a birth field, though the output seems incorrect. And via debugfs we can get the information (crtime as I’m on ext4 file system).

statx support

There is now since Kernel 4.11, a new statx system call, on top of better support of Y2038 or network file systems, it also brings a few extra features like the btime or birth time (creation time) access. Support for ext4 should be in the same kernel release 4.11.

There have been patches to add support to this new syscall in later Kernel releases: e.g. BTRFS and F2FS in Kernel 4.13, SMB3 in 4.14, GFS2 in 4.15, NFS in 4.16, etc.

This system call is wrapped in GNU C library 2.28 and later.

Answered By: Huygens
Categories: Answers Tags: , ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.