atime, ctime and mtime in Unix filesystems

As you know, Unix filesystems store a number of timestamps for each file. This means that you can use these timestamps to find out when any file or directory was last accessed (read from or written to),  changed (file access permissions were changed) or modified (written to).

File and directory timestamps in Unix

Three times tracked for each file in Unix are these:

  • access time atime
  • change time – ctime
  • modify time – mtime

atime – File Access Time

Access time shows the last time the data from a file was accessed – read by one of the Unix processes directly or through commands and scripts.

ctime – File Change Time

ctime also changes when you change file's ownership or access permissions. It will also naturally highlight the last time file had its contents updated.

mtime – File Modify Time

Last modification time shows time of the  last change to file's contents. It does not change with owner or permission changes, and is therefore used for tracking the actual changes to data of the file itself.

Find atime, ctime and mtime with ls

The simplest way to confirm the times associated with a file is to use ls command.

Timestamps are shown when using the long-format output of ls command, ls -l:

ubuntu# ls -l /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:10 /tmp/file1

This is the default output of ls -l, which shows you the time of the last file modification – mtime. In our example, file /tmp/file1 was last changed around 7:10am.

If we want to see the last access time for this file, atime – you need to use -lu options for ls. The output will probably show some later time:

ubuntu# ls -lu /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:27 /tmp/file1

In the example, it's 7:27am.

Lastly, ls -lc will show you the last time our file was changed, ctime:

ubuntu# ls -lc /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:31 /tmp/file1

To show you how this works, I'll change the ownership of the file and then run the same 3 ls commands to show you that only the ctime had been updated. I run the date command just before doing anything else so that you can compare the times:

ubuntu# date
Sat Apr  5 07:35:16 IST 2008
ubuntu# chown root /tmp/file1
ubuntu# ls -lc /tmp/file1
-rw-r--r-- 1 root root 9 2008-04-05 07:35 /tmp/file1
ubuntu# ls -lu /tmp/file1
-rw-r--r-- 1 root root 9 2008-04-05 07:27 /tmp/file1
ubuntu# ls -l /tmp/file1
-rw-r--r-- 1 root root 9 2008-04-05 07:10 /tmp/file1

Show atime, ctime and mtime with stat command

In Linux distributions, you will probably find a stat command, which can be used to show all of the times in a more convenient way, and among plenty of other useful information about your file:

ubuntu# stat /tmp/file1
File: `/tmp/file1'
Size: 9             Blocks: 8          IO Block: 4096   regular file
Device: 811h/2065d    Inode: 179420      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2008-04-05 07:27:51.000000000 +0100
Modify: 2008-04-05 07:10:14.000000000 +0100
Change: 2008-04-05 07:35:22.000000000 +0100

See also:

Share and Enjoy

  • Facebook
  • Twitter
  • Delicious
  • LinkedIn
  • StumbleUpon
  • Add to favorites
  • Email
  • RSS
  • Pingback: Changing atime and mtime for a File in Unix | UNIX Tutorial: Learn UNIX()

  • Pingback: touch - change file timestamps | Unix Commands()

  • Tom

    This page was very helpful today!
    Do you know of any way to see the "create time", so that I could compare it to the last updated time, in order to see how long it took a file to download?

  • Gleb Reys

    Hi Tom,

    create time isn't tracked anywhere, so you can't really determine it. The above mentioned 3 times is all we have.

  • Pingback: On Extracting Transforming and Loading « Allan’s Musings()

  • Zen of Linux

    @Gleb Reys
    Actually this isn't 100% true. (Ext3) and Ext4, especially NTFS support creation time stamps (crtime), the former via the ext_attr option and the latter (unverified) via ntfs-3g. The problem is getting them as no user tools seem to have access…

  • Pingback: How to check the last modified time of the file.()

  • Pingback: How to see future file timestamps in Solaris | Unix Tutorial()

  • Rohit

    Thanks I needed to create a routine for a job to delete old files from the file system .This page is simple to understand and was helpfull to me .

  • Gleb Reys

    You are welcome Rohit, good luck with scripting this!

  • majenkins

    Thanks, just what I was looking for, especially the comment below about create time not being tracked which is what I was really after. I have seen though that our backups seemed to update the changed time whenever they run so it is pretty useless to me for trying to find out other info.