Interrogating the last access timestamp (atime
) can be useful in debugging as well as in security audits in the cases where the filesystem has been mounted to allow the metadata update (i.e. the noatime
mount option has NOT been used).
To this end, some backup software will (or can be configured) to reset the atime
to what it was before the file was backed-up, thus preserving the inherent usefulness of the metadata. In this case, the underlying operating system call, utime
is used, upon which the touch
shell utility is based.
A user who issues touch myfile
would update the 'mtime', 'atime' and 'ctime'. The later represents the last change time for the inode. One can limit changes just to the 'mtime' or 'atime' by adding the corresponding -m
or -a
switch to touch
. In the later cases the ctime
is unconditionally altered --- another trace of potentially useful information.
atime
does have limited usefulness, and many server administrators disable it.touch
can also updatemtime
.touch(1)
adjusts both the last access and the last modification time, you are generally interested in the later. For example,touch xyz.c
has the effect of markingxyz.c
just modified, so for examplemake(1)
will rebuild whatever depends on it.