What are mtime, atime and ctime in Unix?

mtime, atime, and ctime are timestamps associated with the modification, access and change of any file in unix. A common misunderstanding is ‘ctime is file creation time’, but this is not true. ctime means inode/file change time.

File created time is not tracked anywhere in unix, so you can’t really determine it. The below mentioned 3 times is all we have in unix.

mtime

mtime (modification time) indicates the timestamp that the contents of the file has been changed.

Remember,

only the contents. Not the attributes.

For instance, if you open a file and change some (or all) of its content, its mtime gets updated. If you change a file’s attribute (like read-write permissions, metadata), it’s mtime doesn’t change, but ctime will be updated.

Most of the times ctime and mtime will be the same, unless only the file attributes are updated. In that case only the ctime gets updated.

atime

atime (access time) is the timestamp that indicates the time that a file has been accessed.

The file may have been opened by you, or may have been accessed by some other program such as issuing commands or a remote machine.

Anytime a file has been accessed, file access time changes.

ctime

ctime (change time) is the timestamp of a file that indicates the time that it was changed.

Now, the modification can be in terms of its content or in terms of its attributes. Whenever anything about a file changes (except its access time), it’s ctime changes.

The ctime gets updated when the file attributes are changed, like changing the owner, changing the permission or moving the file to another filesystem but will also be updated when you modify a file.

I will demonstrate this by the following example.

See that above timestamps, all are same when we touch the file.

I will try to print the contents of the file using cat command.

Since the unix_text.txt file is empty, it didn’t print anything to output. But looking at file stats, we see the access time has changed, while the mtime and ctime are remain unchanged.

Now, I will write something into the file.

See, all of its timestamps have been changed. Since the file had to be accessed to modify it, the atime has been changed. And since the contents of the file changed, its mtime and ctime both got changed.

Now, instead of contents, what happens if we change its attributes?

Here I have changed the permission to the file and see how it’s ctime has been changed. Since only the attributes were changed and not the contents, the ctime changed while mtime remained as it is.

Comments

comments