How to check file access time, metadata change time, and modification time in Linux ?

Many of us know how to check file modification time by long listing the file.

However we used to avoid a very interesting feature of Linux “ls command” to check the last access time of the file.

Lets check out, how can we check the last access time of a file i.e. when the file was read last time.

Checking ATIME(File last access/read time)

1. Check file last access time using –time option with ls.

[root@nglinux ~]# ls -l  --time=atime file1
-rw-r--r--. 1 root root 6 Jan 10 22:58 file1

2. Read the file and check again it will be updated.

[root@nglinux ~]# cat file1
hello
[root@nglinux ~]# ls -l  --time=atime file1
-rw-r--r--. 1 root root 6 Jan 10 23:02 file1
[root@nglinux ~]# 

Alongwith atime, we have mtime and ctime also recorded in Linux.

Lets see what is mtime and how to check it.

Checking MTIME(File last modification time)
Mtime is the last modification time of a file. Modification time changes whenever we change file content using vim or any other editor.
We can see the mtime of a file using “ls -l” command.

[root@nglinux ~]# ls -l file1
-rw-r--r--. 1 root root 6 Jan 10 23:00 file1
[root@nglinux ~]# 

Hence the file “file1” was last modified on Jan10, at 23:00 PM.

Checking CTIME(File last metadata change time, for example permissions/attributes)
CTIME first records the file creation time, and then updates whenever the file metadata is modified. Lets see an example where CTIME is more than file’s last access time.

### Lets change the file1 attribute.
[root@nglinux ~]# chattr +i file1

### Now check its ctime is modified.
[root@nglinux ~]# ls -l --time=ctime file1
-rw-r--r--. 1 root root 6 Jan 10 23:11 file1

### we can compare ctime is more than atime in this case.
[root@nglinux ~]# ls -l --time=atime file1
-rw-r--r--. 1 root root 6 Jan 10 23:09 file1

Interesting example 🙂 Now you know what is ctime, atime and mtime.

People sometimes call CTIME as file creation time, however its not correct. It is same, when file permissions/attributes are not changed otherwise its wrong.

Please do post your comments/feedback.

0 0 votes
Article Rating
Subscribe
Notify of
guest

1 Comment
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
Anonymous
Anonymous
3 years ago

how do i check programmatically if the file has been accessed say within the last hour or so? (whithout having to write complicated data parsing of ls output)