Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just know that ls -t and ls -f give different sorting of files and subdirectories under a directory.

  • What are the differences between timestamp, modification time, and created time of a file?
  • How to get and change these kinds of information by commands?
  • In terms of what kind of information do people say a file is "newer" than the other?
  • What kinds of information's change will not make the file different?

For example, I saw someone wrote:

By default, the rsync program only looks to see if the files are different in size and timestamp. It doesn't care which file is newer, if it is different, it gets overwritten. You can pass the '--update' flag to rsync which will cause it to skip files on the destination if they are newer than the file on the source, but only so long as they are the same type of file. What this means is that if, for example, the source file is a regular file and the destination is a symlink, the destination file will be overwritten, regardless of timestamp.

On a side note, does the file type here mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

share|improve this question
up vote 56 down vote accepted

There are 3 kind of "timestamps":

  • Access - the last time the file was read
  • Modify - the last time the file was modified (content has been modified)
  • Change - the last time meta data of the file was changed (e.g. permissions)

To display this information, you can use stat which is part of the coreutils.

stat will show you also some more information like the device, inodes, links, etc.

Remember that this sort of information depends highly on the filesystem and mount options. For example if you mount a partition with the noatime option, no access information will be written.

A utility to change the timestamps would be touch. There are some arguments to decide which timestamp to change (e.g. -a for access time, -m for modification time, etc.) and to influence the parsing of a new given timestamp. See man touch for more details.

touch can become handy in combination with cp -u ("copy only when the SOURCE file is newer than the destination file or when the destination file is missing") or for the creation of empty marker files.

share|improve this answer
Thanks! For rsync command, in "it doesn't care which file is newer", in terms of which kind of timestamp does it mean by "newer". Also, on a side note, does the file type that rsync cares about mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc? – Tim Sep 27 '10 at 15:44
Generally, reference to the time of a file is the "modified" timestamp. For example, what you see from ls -l. And the file type refers to file vs. symlink (or other types of files like directories or devices). Not what the type of data in the file is (text vs. jpeg, etc). – Seth L Sep 27 '10 at 18:12
@Tim In that context it's the modified timestamp; rsync is saying that when it's deciding if it should back up a file, it doesn't check to see if the source file has been modified more recently than the existing backup (which is common with backup programs); it just checks to see if the files have different sizes or different modification times and backs up if so – Michael Mrozek Sep 27 '10 at 18:58
And how do I know when the file was created first? Is this information maintained somewhere at all or is lost in updates? so to say, how long the file has been in existence..? – xyz Nov 16 '11 at 10:07
The stat(2) man page describes in more detail when those timestamps are changed. – Cristian Ciupitu Jul 31 '14 at 16:11

The answer of echox is valid but I want to add information regarding file creation time.

Some file systems support an additional entry in the inode regarding the creation time (or birth time). I know that ext4 supports this feature and also JFS and BTRFS.

However most tools and API have not yet been updated to read this extra information. So even-though it could be there, it's not accessible.

For instance on Ubuntu 12.04 LTS I get the following for a file I created today:

$ echo Just another test > /tmp/mytest
$ sleep 3
$ touch /tmp/mytest
$ sleep 2
$ cat /tmp/mytest > /dev/null
$ stat /tmp/mytest 
Access: 2012-06-05 13:33:44.279774711 +0200
Modify: 2012-06-05 13:33:34.611893317 +0200
Change: 2012-06-05 13:33:34.611893317 +0200
 Birth: -
$ sudo debugfs -R 'stat /tmp/mytest' /dev/sda1
 ctime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
 atime: 0x4fcdee98:42b417dc -- Tue Jun  5 13:33:44 2012
 mtime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
crtime: 0x4fcdee46:01258f1c -- Tue Jun  5 13:32:22 2012

You can see that the newer stat function has a birth field, though the output seems incorrect. And via debugfs we can get the information (crtime as I'm on ext4 file system).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.