124

I just know that ls -t and ls -f give different sorting of files and subdirectories under a directory.

  • What are the differences between timestamp, modification time, and created time of a file?
  • How to get and change these kinds of information by commands?
  • In terms of what kind of information do people say a file is "newer" than the other?
  • What kinds of information's change will not make the file different?

For example, I saw someone wrote:

By default, the rsync program only looks to see if the files are different in size and timestamp. It doesn't care which file is newer, if it is different, it gets overwritten. You can pass the '--update' flag to rsync which will cause it to skip files on the destination if they are newer than the file on the source, but only so long as they are the same type of file. What this means is that if, for example, the source file is a regular file and the destination is a symlink, the destination file will be overwritten, regardless of timestamp.

On a side note, does the file type here mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

1

2 Answers 2

170

There are 3 kind of "timestamps":

  • Access - the last time the file was read
  • Modify - the last time the file was modified (content has been modified)
  • Change - the last time meta data of the file was changed (e.g. permissions)

To display this information, you can use stat which is part of the coreutils.

stat will show you also some more information like the device, inodes, links, etc.

Remember that this sort of information depends highly on the filesystem and mount options. For example if you mount a partition with the noatime option, no access information will be written.

A utility to change the timestamps would be touch. There are some arguments to decide which timestamp to change (e.g. -a for access time, -m for modification time) and to influence the parsing of a new given timestamp. See man touch for more details.

touch can become handy in combination with cp -u ("copy only when the SOURCE file is newer than the destination file or when the destination file is missing") or for the creation of empty marker files.

7
  • 1
    Thanks! For rsync command, in "it doesn't care which file is newer", in terms of which kind of timestamp does it mean by "newer". Also, on a side note, does the file type that rsync cares about mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?
    – Tim
    Sep 27, 2010 at 15:44
  • 2
    Generally, reference to the time of a file is the "modified" timestamp. For example, what you see from ls -l. And the file type refers to file vs. symlink (or other types of files like directories or devices). Not what the type of data in the file is (text vs. jpeg, etc).
    – Seth L
    Sep 27, 2010 at 18:12
  • 2
    @Tim In that context it's the modified timestamp; rsync is saying that when it's deciding if it should back up a file, it doesn't check to see if the source file has been modified more recently than the existing backup (which is common with backup programs); it just checks to see if the files have different sizes or different modification times and backs up if so Sep 27, 2010 at 18:58
  • 4
    And how do I know when the file was created first? Is this information maintained somewhere at all or is lost in updates? so to say, how long the file has been in existence..?
    – xyz
    Nov 16, 2011 at 10:07
  • 1
    The stat(2) man page describes in more detail when those timestamps are changed. Jul 31, 2014 at 16:11
41

The answer of echox is valid but I want to add information regarding file creation time.

File System Support

Some file systems support an additional entry in the inode regarding the creation time (or birth time). I know that ext4 supports this feature and also JFS and BTRFS.

However most tools and API have not yet been updated to read this extra information. So even-though it could be there, it's not accessible.

For instance on Ubuntu 12.04 LTS I get the following for a file I created today:

$ echo Just another test > /tmp/mytest
$ sleep 3
$ touch /tmp/mytest
$ sleep 2
$ cat /tmp/mytest > /dev/null
$ stat /tmp/mytest 
[...]
Access: 2012-06-05 13:33:44.279774711 +0200
Modify: 2012-06-05 13:33:34.611893317 +0200
Change: 2012-06-05 13:33:34.611893317 +0200
 Birth: -
$ sudo debugfs -R 'stat /tmp/mytest' /dev/sda1
[...]
 ctime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
 atime: 0x4fcdee98:42b417dc -- Tue Jun  5 13:33:44 2012
 mtime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
crtime: 0x4fcdee46:01258f1c -- Tue Jun  5 13:32:22 2012
[...]

You can see that the newer stat function has a birth field, though the output seems incorrect. And via debugfs we can get the information (crtime as I'm on ext4 file system).

statx support

There is now since Kernel 4.11, a new statx system call, on top of better support of Y2038 or network file systems, it also brings a few extra features like the btime or birth time (creation time) access. Support for ext4 should be in the same kernel release 4.11.

There have been patches to add support to this new syscall in later Kernel releases: e.g. BTRFS and F2FS in Kernel 4.13, SMB3 in 4.14, GFS2 in 4.15, NFS in 4.16, etc.

This system call is wrapped in GNU C library 2.28 and later.

3
  • Do you know if btime remains intact when files from Windows (Creation time) are moved onto ext4 and vice versa, like mtime?
    – paradroid
    Jan 20, 2019 at 4:07
  • @paradroid sorry I do not know the answer. If you mean under Linux when copying a file from NTFS to ext4, one would need to look in the NTFS driver if it supports creation time. If you mean under Windows, one would need to look in the ext4 driver for Windows.
    – Huygens
    Jan 20, 2019 at 14:19
  • @Huygens On my system /tmp is a tmpfs so I created the mytest file on another ext4 LV mounted on /myTmp. Now let myFile=/myTmp/mytest, then the command sudo debugfs -R "stat $myFile" $(findmnt -n -o source -T $myFile) says /myTmp/mytest: File not found by ext2_lookup
    – SebMa
    Aug 18 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.