In the Linux system, the system provides a file with three timestamps, namely access timestamp (atime), change timestamp (mtime), and change timestamp (ctime). Linux stores the timestamp in the Unix epoch instead of the actual date and time. The Unix epoch is the number of seconds from 00:00:00 on January 1, 1970.
This article will help you understand Linux file timestamps and how file timestamps work. I have used for all the examples in this article an Ubuntu 20.04 system. Let's first discuss the definition and how we can display it in our Linux system.
Access Timestamp (atime)
When you access the file through any command, process, and script the system will update the access time of the file or document. In general, access timestamp refers to the last time when the system or the user used a program or command to display the content inside the files. You can use the ls command with the -lu option to view the atime.
$ ls -lu /var/log
Viewing Access Time.
Modified Timestamp (mtime)
When you change the content inside the file the Linux system updates the mtime of the file. Modified Timestamp indicates the last time a file gets modified whether you append, edit or remove the content inside the file. You view the modified time using the ls command with the -l option to the command.
$ ls -l /var/log
Viewing Modified Time.
Changed Timestamp (ctime)
When you change the file-related metadata i.e file permission, file ownership, etc., then the ctime of the file gets updated. Changed Timestamp also records time when you modify the file. You can view the ctime of the file by using the -lc option to the ls command.
$ ls -lc /var/log
Viewing Changed Timestamp.
How does file timestamp work?
As mentioned earlier the system doesn’t store the actual date and time; instead, it stores it in the number of seconds in Unix Epoch or Unix Time. Whenever we view the file timestamp the system will change the number of seconds into human-readable format.
Let’s see how the timestamp is applied to the file. Use the touch command to create a new file and check all three timestamps using the stat command. The stat is a command-line utility to view more details about the files or in general to view the detailed timestamp of the file.
$ touch file.txt
Then view the timestamp using the stat command. The stat command shows all three timestamps at once so you don’t need to multiple checks the timestamp.
$ stat file.txt
Creating new file & checking stat.
As you can see all three timestamps have the same date and time. Similarly, let’s view the file content and then check the timestamp.
$ cat file.txt
$ stat file.txt
Viewing file content.
As you can see the access time is updated to the time when we view the file. Again, Let’s try adding some text to the file and check the stat.
$ vim file.txt
Adding text to file.
Checking file stat after text added.
As you can see in the above example all the timestamps of the file are being updated.
Conclusion
TIll now we have discussed three timestamps in the Linux system i.e. atime, mtime, and ctime. These files timestamps are important as they track the record of the file being viewed and modified so it’s easy to organize files based on these timestamps. I hope you like this article.