Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a command in Linux to check all timestamps of a file?

I'm trying to see the last modified, created, and touched dates on the file.

share|improve this question
2  
Just to point out, Linux files don't have birth dates. Thus, it's not possible to determine the date a file was created. –  FatalError Feb 7 '12 at 15:12
    
noticed that =(. Thanks for pointing it out to me. –  Mechaflash Feb 7 '12 at 15:25
2  
@FatalError: Various filesystems already support birth/creation timestamps; the real trouble is in accessing such extra information. (One can't just extend struct stat without breaking things, unfortunately...) You can try out debugfs -R "stat <1234>" /dev/sdXY for ext4, replacing 1234 with an ino. –  grawity Feb 7 '12 at 17:03
    
@grawity: Neat! I always wondered why no fs had it... but I guess they do, but like you said, can't just go breaking the ABI for existing binaries. Thanks for the tip :). –  FatalError Feb 7 '12 at 17:45
    
@FatalError: So why does stat <file> show a Birth timestamp that is the time when <file> was created? Is it just a coincidence? Is it the birthdate of the inode? –  orangechicken Dec 31 '13 at 23:32

2 Answers 2

up vote 14 down vote accepted

The command is basically called stat.

charon:Desktop werner$ stat test
234881026 41570368 -rw-r--r-- 1 werner staff 0 0 "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" 4096 0 0 test

If you want to adjust the format, refer to the manpages, since the output is OS-specific and varies under Linux/Unix.

Generally, you can get the times through a normal directory listing as well:

  • ls -l outputs last time the file content was modified, the mtime
  • ls -lc outputs last time of file status modification, the ctime (What's the difference?)
  • ls -lu outputs last access time (although the usefulness of this concept is subject to discussion)

And of course, ctime does not record when a file was "created". This is not possible in Unix (as @FatalError already stated in the comment above).

share|improve this answer
    
+1 Thank you so much =D. –  Mechaflash Feb 7 '12 at 15:10

There are only THREE distinct times values stored for each of your files, as defined by the POSIX Standard : http://pubs.opengroup.org/onlinepubs/9699919799/ (see Base Definitions section -> 4. General Concepts -> 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in <sys/stat.h>.

And from <sys/stat.h> :

atime is for Last data access timestamp.
mtime is for Last data modification timestamp.
ctime is for Last file status change timestamp.

Following examples show the difference among the atime, mtime and ctime. These examples are in GNU/Linux BASH, in Mac OS X or other BSD Dist. use stat -x to see the similar output format.

$ stat --version
stat (GNU coreutils) 8.4
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Michael Meskes.
$
$ touch test
$ stat test
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:58:28.609223953 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 10:58:28.609223953 +0800

When the file just be created, three timestamps are the same.


First, let's access the file's data by reading it (less or vim), printing it out (cat) or copy it to another file (cp).

$ cat test #Nothing will be printed out, since the file is empty
$ stat test
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800  <-- atime Changed!
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 10:58:28.609223953 +0800

Now let's change the file status, by changing the permission (chmod) or renaming it (mv)

$ chmod u+x test
$ stat stet
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 11:04:10.178285430 +0800  <-- ctime Changed!
$    
$ mv test testing
$ stat testing
  File: `testing'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 11:06:33.342207679 +0800  <-- ctime Changed again!

Note that until now, the contents (data) of the file is still the same as when it created.


Finally, let's modify the contents of the file by editing the file.

$ echo 'Modify the DATA of the file' > testing
$ echo 'Modify the DATA of the file also change the file status' > testing
$ stat testing
  File: `testing'
  Size: 56          Blocks: 8          IO Block: 4096   regular file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 11:09:48.247345148 +0800  <-- mtime Changed!
Change: 2014-03-16 11:09:48.247345148 +0800  <-- ctime also Changed!

Also note that the newer version of stat (e.g. stat --version 8.13 in Ubuntu 12.04) has 4th timestamp information - the Birth Time (file creation time). Although it may not show the correct time for now:

$ stat --version
stat (GNU coreutils) 8.13
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Michael Meskes.
$
$ stat birth_time
  File: `birth_time'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 805h/2053d  Inode: 4073946     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/ bingyao)   Gid: ( 1000/ bingyao)
Access: 2014-03-16 10:46:48.838718970 +0800
Modify: 2014-03-16 10:46:48.838718970 +0800
Change: 2014-03-16 10:46:48.838718970 +0800
 Birth: -
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.