112

I just know that ls -t and ls -f give different sorting of files and subdirectories under a directory.

  • What are the differences between timestamp, modification time, and created time of a file?
  • How to get and change these kinds of information by commands?
  • In terms of what kind of information do people say a file is "newer" than the other?
  • What kinds of information's change will not make the file different?

For example, I saw someone wrote:

By default, the rsync program only looks to see if the files are different in size and timestamp. It doesn't care which file is newer, if it is different, it gets overwritten. You can pass the '--update' flag to rsync which will cause it to skip files on the destination if they are newer than the file on the source, but only so long as they are the same type of file. What this means is that if, for example, the source file is a regular file and the destination is a symlink, the destination file will be overwritten, regardless of timestamp.

On a side note, does the file type here mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

| improve this question | |
152

There are 3 kind of "timestamps":

  • Access - the last time the file was read
  • Modify - the last time the file was modified (content has been modified)
  • Change - the last time meta data of the file was changed (e.g. permissions)

To display this information, you can use stat which is part of the coreutils.

stat will show you also some more information like the device, inodes, links, etc.

Remember that this sort of information depends highly on the filesystem and mount options. For example if you mount a partition with the noatime option, no access information will be written.

A utility to change the timestamps would be touch. There are some arguments to decide which timestamp to change (e.g. -a for access time, -m for modification time) and to influence the parsing of a new given timestamp. See man touch for more details.

touch can become handy in combination with cp -u ("copy only when the SOURCE file is newer than the destination file or when the destination file is missing") or for the creation of empty marker files.

| improve this answer | |
  • 1
    Thanks! For rsync command, in "it doesn't care which file is newer", in terms of which kind of timestamp does it mean by "newer". Also, on a side note, does the file type that rsync cares about mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc? – Tim Sep 27 '10 at 15:44
  • 2
    Generally, reference to the time of a file is the "modified" timestamp. For example, what you see from ls -l. And the file type refers to file vs. symlink (or other types of files like directories or devices). Not what the type of data in the file is (text vs. jpeg, etc). – Seth L Sep 27 '10 at 18:12
  • 2
    @Tim In that context it's the modified timestamp; rsync is saying that when it's deciding if it should back up a file, it doesn't check to see if the source file has been modified more recently than the existing backup (which is common with backup programs); it just checks to see if the files have different sizes or different modification times and backs up if so – Michael Mrozek♦ Sep 27 '10 at 18:58
  • 2
    And how do I know when the file was created first? Is this information maintained somewhere at all or is lost in updates? so to say, how long the file has been in existence..? – xyz Nov 16 '11 at 10:07
  • 1
    The stat(2) man page describes in more detail when those timestamps are changed. – Cristian Ciupitu Jul 31 '14 at 16:11
39

The answer of echox is valid but I want to add information regarding file creation time.

File System Support

Some file systems support an additional entry in the inode regarding the creation time (or birth time). I know that ext4 supports this feature and also JFS and BTRFS.

However most tools and API have not yet been updated to read this extra information. So even-though it could be there, it's not accessible.

For instance on Ubuntu 12.04 LTS I get the following for a file I created today:

$ echo Just another test > /tmp/mytest
$ sleep 3
$ touch /tmp/mytest
$ sleep 2
$ cat /tmp/mytest > /dev/null
$ stat /tmp/mytest 
[...]
Access: 2012-06-05 13:33:44.279774711 +0200
Modify: 2012-06-05 13:33:34.611893317 +0200
Change: 2012-06-05 13:33:34.611893317 +0200
 Birth: -
$ sudo debugfs -R 'stat /tmp/mytest' /dev/sda1
[...]
 ctime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
 atime: 0x4fcdee98:42b417dc -- Tue Jun  5 13:33:44 2012
 mtime: 0x4fcdee8e:91e30114 -- Tue Jun  5 13:33:34 2012
crtime: 0x4fcdee46:01258f1c -- Tue Jun  5 13:32:22 2012
[...]

You can see that the newer stat function has a birth field, though the output seems incorrect. And via debugfs we can get the information (crtime as I'm on ext4 file system).

statx support

There is now since Kernel 4.11 a new statx system call, on top of better support of Y2038 or network file systems, it also brings a few extra features like the btime or birth time (creation time) access. Support for ext4 should be in the same kernel release 4.11.

There have been patches to add support to this new syscall in later Kernel releases: e.g. BTRFS and F2FS in Kernel 4.13, SMB3 in 4.14, GFS2 in 4.15, NFS in 4.16, etc.

The up coming glibc will provide a function call to query this interface (see Phoronix news about glibc statx support). So we can expect support for this feature in user space pretty soon.

| improve this answer | |
  • Do you know if btime remains intact when files from Windows (Creation time) are moved onto ext4 and vice versa, like mtime? – paradroid Jan 20 '19 at 4:07
  • @paradroid sorry I do not know the answer. If you mean under Linux when copying a file from NTFS to ext4, one would need to look in the NTFS driver if it supports creation time. If you mean under Windows, one would need to look in the ext4 driver for Windows. – Huygens Jan 20 '19 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.