Linux Timestamps: The Difference Between atime, mtime, ctime, and crtime

The Linux filesystem keeps track of different timestamps for each file on the system: mtime, atime, ctime, and crtime, all of which represent different file activities.

Description of Each Timestamp

atime is the last accessed time, which updates when the file contents are read through commands such as cat and grep or by an application.

mtime is the last modification time, which updates when you change the contents of a file.

ctime is the last change time, which updates when the file’s properties (i.e. permissions, name, location) change.

crtime is the creation time, which doesn’t update.

It’s important to remember the following:

• atime can update by itself
• When ctime updates, atime updates
• When mtime updates, ctime and atime updates

How to Check Each Timestamp

We can use variations of ls to check individual timestamps.

ls -l will give us mtime.

ls -lu will give us atime.

ls -lc will give us ctime.

We can append a filename to each of these to find the timestamp for a specific file.

In order to view all timestamps at once for a specific file, we can use stat file.txt.

We can also use fls and mactime to create a timeline of file activity, which specifies, in chronological order, when each file in the specified directory was created, accessed, and modified.

Uses

Knowing this can be very helpful in a variety of situations. It can help you:

• Confirm that a file or directory was last modified on a specific date
• Quickly find files that were recently updated
• Verify if a file was ever accessed or moved