52

Is there a command in Linux to check all timestamps of a file?

I'm trying to see the last modified, created, and touched dates on the file.

  • 4
    Just to point out, Linux files don't have birth dates. Thus, it's not possible to determine the date a file was created. – FatalError Feb 7 '12 at 15:12
  • noticed that =(. Thanks for pointing it out to me. – Mechaflash Feb 7 '12 at 15:25
  • 4
    @FatalError: Various filesystems already support birth/creation timestamps; the real trouble is in accessing such extra information. (One can't just extend struct stat without breaking things, unfortunately...) You can try out debugfs -R "stat <1234>" /dev/sdXY for ext4, replacing 1234 with an ino. – grawity Feb 7 '12 at 17:03
  • @grawity: Neat! I always wondered why no fs had it... but I guess they do, but like you said, can't just go breaking the ABI for existing binaries. Thanks for the tip :). – FatalError Feb 7 '12 at 17:45
  • 1
    @FatalError, Birth time can be displayed with Linux stat command, see How to find creation date of file? and What file systems on Linux store the creation time?. – Franklin Piat Mar 27 '15 at 21:23
73

The command is called stat.

$ stat test
234881026 41570368 -rw-r--r-- 1 werner staff 0 0 "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" "Feb  7 16:03:06 2012" 4096 0 0 test

If you want to adjust the format, refer to the man pages, since the output is OS-specific and varies under Linux/Unix.

Generally, you can get the times through a normal directory listing as well:

  • ls -l outputs last time the file content was modified, the mtime
  • ls -lc outputs last time of file status modification, the ctime (What's the difference?)
  • ls -lu outputs last access time, the atime (although the usefulness of this concept is subject to discussion)

And of course, ctime does not record when a file was "created". The POSIX specification defines only three timestamps, but some Linux filesystems store Birth Time/Creation Time. How to find creation date of file? On such a supported configuration, one could use

stat --printf '%n\nmtime: %y\nctime: %z\natime: %x\ncrtime:%w\n'
  • stat is really detailed. But ls only needs one line. It would be good if it could also display seconds. However, when creating lists of files, the former one is perfectly suitable. – neverMind9 Nov 7 '18 at 20:28
  • ls -l was the quick solution for me – Andrew Nov 23 '18 at 15:08
  • I've noticed that the result of ls -l can show a different date format when there is BusyBox installed (on Android). I think that without it , it's like "2019-07-26 14:41" , and with it, it's like "May 6 21:27" . How come the year is missing ? Is there a way to force it using the format of without it? – android developer Jul 26 at 12:21
  • @androiddeveloper Like I said, the answer depends on the OS. I think you should open a new question. If you are talking about Android specifically, perhaps Stack Overflow or Android Enthusiasts would be more fitting. – slhck Jul 26 at 12:37
  • @slhck Well it's the same OS, just with BusyBox installed. I asked if it's possible (meaning : is there a command to use) to get the format that will be shown. – android developer Jul 27 at 6:32
21

There are only THREE distinct times values stored for each of your files, as defined by the POSIX Standard : http://pubs.opengroup.org/onlinepubs/9699919799/ (see Base Definitions section -> 4. General Concepts -> 4.8 File Times Update)

Each file has three distinct associated timestamps: the time of last data access, the time of last data modification, and the time the file status last changed. These values are returned in the file characteristics structure struct stat, as described in <sys/stat.h>.

And from <sys/stat.h> :

atime is for Last data access timestamp.
mtime is for Last data modification timestamp.
ctime is for Last file status change timestamp.

Following examples show the difference among the atime, mtime and ctime, these examples are in GNU/Linux BASH. You can use stat -x in Mac OS X or other BSD Dist. to see the similar output format.

$ stat --version
stat (GNU coreutils) 8.4
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Michael Meskes.
$
$ touch test
$ stat test
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:58:28.609223953 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 10:58:28.609223953 +0800

When the file just be created, three timestamps are the same.


1. atime

First, let's access the file's data by reading it (less or vim), printing it out (cat) or copy it to another file (cp).

$ cat test #Nothing will be printed out, since the file is empty
$ stat test
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800  <-- atime Changed!
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 10:58:28.609223953 +0800

2. ctime

Now let's change the file status, by changing the permission (chmod) or renaming it (mv)

$ chmod u+x test
$ stat stet
  File: `test'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 11:04:10.178285430 +0800  <-- ctime Changed!
$    
$ mv test testing
$ stat testing
  File: `testing'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 10:58:28.609223953 +0800
Change: 2014-03-16 11:06:33.342207679 +0800  <-- ctime Changed again!

Note that until now, the contents (data) of the file is still the same as when it created.


3. mtime

Finally, let's modify the contents of the file by editing the file.

$ echo 'Modify the DATA of the file' > testing
$ echo 'Modify the DATA of the file also change the file status' > testing
$ stat testing
  File: `testing'
  Size: 56          Blocks: 8          IO Block: 4096   regular file
Device: 811h/2065d  Inode: 98828525    Links: 1
Access: (0764/-rwxrw-r--)  Uid: (  514/    rank)   Gid: (  514/    rank)
Access: 2014-03-16 10:59:13.182301069 +0800
Modify: 2014-03-16 11:09:48.247345148 +0800  <-- mtime Changed!
Change: 2014-03-16 11:09:48.247345148 +0800  <-- ctime also Changed!

4. birth time

Also note that the newer version of stat (e.g. stat --version 8.13 in Ubuntu 12.04) has 4th timestamp information - the Birth Time (file creation time). Although it may not show the correct time for now:

$ stat --version
stat (GNU coreutils) 8.13
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Michael Meskes.
$
$ stat birth_time
  File: `birth_time'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 805h/2053d  Inode: 4073946     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/ bingyao)   Gid: ( 1000/ bingyao)
Access: 2014-03-16 10:46:48.838718970 +0800
Modify: 2014-03-16 10:46:48.838718970 +0800
Change: 2014-03-16 10:46:48.838718970 +0800
 Birth: -
  • What is the meaning of 10:46:48.838718970? HH:MM:SS. nanoseconds? – Dzung Nguyen Sep 13 '16 at 17:35
  • 2
    Yes. "Since kernel 2.5.48, the stat structure supports nanosecond resolution for the three file timestamp fields...." – Tom Lord Oct 4 '16 at 9:29
  • Creation time can be figured out with root access and debugfs if needed: moiseevigor.github.io/software/2015/01/30/… – Mikko Rantalainen Mar 14 '18 at 14:36
  • 2
    Birth time… gladly. Because last modified and last change is nearly for the same purpose but still distinct. It is good if all four exist. – neverMind9 Nov 7 '18 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.