Interrogating the last access timestamp (
atime) can be useful in debugging as well as in security audits in the cases where the filesystem has been mounted to allow the metadata update (i.e. the
noatime mount option has NOT been used).
To this end, some backup software will (or can be configured) to reset the
atime to what it was before the file was backed-up, thus preserving the inherent usefulness of the metadata. In this case, the underlying operating system call,
utime is used, upon which the
touch shell utility is based.
A user who issues
touch myfile would update the 'mtime', 'atime' and 'ctime'. The later represents the last change time for the inode. One can limit changes just to the 'mtime' or 'atime' by adding the corresponding
-a switch to
touch. In the later cases the
ctime is unconditionally altered --- another trace of potentially useful information.