File timestamps
Files that are created and used on Linux systems have three different timestamps available: access time (atime), modify time (mtime) and change time (ctime). The modification time will commonly be the default timestamp used in file managers and shell comments like ls.
Linux timestamps explained[edit]
All common Linux file systems have the following timestamps available:
| Timestamp | Function |
|---|---|
mtime
|
Modification time. It is changed when a files contents are changed. |
ctime
|
Status Change time is updated when a files property or metadata was changed. It is always updated when a file is modified and mtime is updated. ctime is also updated when file permissions, file ownership, file name or location are changed. mv myfile yourfile will only change the files ctime.
|
atime
|
Access time indicates when a file was last accessed. Just opening or reading a file will change the access timestamp. |
The xfs and ext4 file systems have an additional timestamp which is available using the statx system call in linux kernels >= 4.15:[1]
| Timestamp | Function |
|---|---|
| btime | birth / creation time. This timestmap reflects when a file was first created on the local file system. |
btime is not available when a remote file system is mounted using nfs.
 |
Note: The btime / creation time stamp reflects when a file was first written to the file system. A file created on another device which is copied over to a new file system can therefore have modification and access time stamps prior to the files creation on the local file system.
The birth time stamp will only reflect when a file was actually created if it was originally made on the local file system. |
Viewing file timestamps[edit]
The unix system call stat() returns a files (actually, inodes) file attributes. A Linux command called stat can be used to view this information, just execute stat filename and it will, with no other arguments, list it's access time (atime), modification time (mtime), change time (ctime) and, if available, creation time (birth).
ls, "list files", can display Unix/Linux timestamps when it's -l for long (detailed) output is used.
| ls argument | Function |
|---|---|
ls -lu
|
List files with last access time |
ls -l
|
show a files modification time (default for -l so no other argument is required)
|
ls -lc
|
list a files change time |
ls does not, as of early 2020, support showing a files creation (birth) time on supported file systems. Use stat filename if you need to get that piece of information.
Graphical file managers[edit]
thunar is not about to let you or your family know when a file was created even if the file has a creation timestamp available. You will have to use stat or another file manager to get that information.
Graphical file managers will show file timestamps if you right-click on a file and select Properties. Some file managers, like KDEs dolphin and Cinnamons Nemo[2], will show creation time (birth), access time and modification time while other file mangers like Xfce4s Thunar will ONLY show you access time and modification time[3]. It is not a given that all graphical file managers support showing a files creation time.
Dolphin will show you a when a file was created as well as modification time and access time. Creation time will only be shown on local ext4 and xfs file systems.
The Nemo file manager from Linux Mints Cinnamon desktop can show file creation timestamps.
The Resource-Waste of atime[edit]
The atime or access time stamp reflects when a file is accessed which means that it is updated when a file is merely read. Adding a disk write to read operations is a complete waste of system resources. Various proposals have been made to remedy the silliness of doing writes when a file is read. This has resulted in five mount options being available for those who want to modify their /etc/fstab file system tabulator in order to either make atime updates be less wasteful or make them go away.
| mount option | function |
|---|---|
| strictatime | Always update atime, which conforms to the behavior defined by POSIX |
| relatime | "relative atime". Default in current kernels. Only update atime under certain circumstances: if the previous atime is older than the mtime or ctime, or the previous atime is over 24 hours in the past |
| nodiratime | never update atime of directories, but do update atime of other files |
| noatime | never update atime of any file or directory; implies nodiratime; highest performance, but least compatible |
| lazytime | update atime according to specific circumstances laid out below |
noatime is a great choice if you want to add something to your file systems options in /etc/fstab.
Enable comment auto-refresher