timestamp, modification time, and created time of a file

  • I just know that ls -t and ls -f give different sorting of files and subdirectories under a directory.

    • What are the differences between timestamp, modification time, and created time of a file?
    • How to get and change these kinds of information by commands?
    • In terms of what kind of information do people say a file is "newer" than the other?
    • What kinds of information's change will not make the file different?

    For example, I saw someone wrote:

    By default, the rsync program only looks to see if the files are different in size and timestamp. It doesn't care which file is newer, if it is different, it gets overwritten. You can pass the '--update' flag to rsync which will cause it to skip files on the destination if they are newer than the file on the source, but only so long as they are the same type of file. What this means is that if, for example, the source file is a regular file and the destination is a symlink, the destination file will be overwritten, regardless of timestamp.

    On a side note, does the file type here mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

  • echox

    echox Correct answer

    10 years ago

    There are 3 kind of "timestamps":

    • Access - the last time the file was read
    • Modify - the last time the file was modified (content has been modified)
    • Change - the last time meta data of the file was changed (e.g. permissions)

    To display this information, you can use stat which is part of the coreutils.

    stat will show you also some more information like the device, inodes, links, etc.

    Remember that this sort of information depends highly on the filesystem and mount options. For example if you mount a partition with the noatime option, no access information will be written.

    A utility to change the timestamps would be touch. There are some arguments to decide which timestamp to change (e.g. -a for access time, -m for modification time) and to influence the parsing of a new given timestamp. See man touch for more details.

    touch can become handy in combination with cp -u ("copy only when the SOURCE file is newer than the destination file or when the destination file is missing") or for the creation of empty marker files.

    Thanks! For rsync command, in "it doesn't care which file is newer", in terms of which kind of timestamp does it mean by "newer". Also, on a side note, does the file type that rsync cares about mean only regular file and simlink, not the type such as pdf, jpg, htm, txt etc?

    Generally, reference to the time of a file is the "modified" timestamp. For example, what you see from `ls -l`. And the file type refers to file vs. symlink (or other types of files like directories or devices). *Not* what the type of data in the file is (text vs. jpeg, etc).

    @Tim In that context it's the modified timestamp; rsync is saying that when it's deciding if it should back up a file, it doesn't check to see if the source file has been modified more recently than the existing backup (which is common with backup programs); it just checks to see if the files have different sizes or different modification times and backs up if so

    And how do I know when the file was created first? Is this information maintained somewhere at all or is lost in updates? so to say, how long the file has been in existence..?

    The stat(2) man page describes in more detail when those timestamps are changed.

    @xyz, besides the fact that some filesystems do not store a field for "create" time, some apps make it hard to maintain. Imagine an editor that writes the data to a temp file, then renames it to the real name on save. Just editing could nuke the data.

License under CC-BY-SA with attribution


Content dated before 6/26/2020 9:53 AM