As you know, Unix filesystems store a number of timestamps for each file. This means that you can use these timestamps to find out when any file or directory was last accessed (read from or written to), changed (file access permissions were changed) or modified (written to).
File and directory timestamps in Unix
Three times tracked for each file in Unix are these:
- access time - atime
- change time - ctime
- modify time - mtime
atime - File Access Time
Access time shows the last time the data from a file was accessed - read by one of the Unix processes directly or through commands and scripts.
ctime - File Change Time
ctime indicates the last time a file’s metadata (inode) was changed. It changes when you change file's ownership or access permissions. The Linux man page for stat summarizes ctime behavior nicely: “The field st_ctime is changed by writing or by setting inode information (i.e., owner, group, link count, mode, etc.).”
mtime - File Modify Time
Last modification time shows time of the last change to file's contents. It does not change with owner or permission changes, and is therefore used for tracking the actual changes to data of the file itself.
Find atime, ctime and mtime with ls
The simplest way to confirm the times associated with a file is to use ls command.