Modifying File Timestamps in Linux Using touch
Introduction
In Linux, every file contains metadata that includes several timestamps:
- Access time (
atime
) — Last time the file was read. - Modification time (
mtime
) — Last time the file’s content was changed. - Change time (
ctime
) — Last time the file’s metadata (e.g., permissions, ownership) was changed. - Birth time — The file’s creation time (available only on certain filesystems and kernels).
The touch
command is commonly used to update the access and modification times. However, note that Linux does not allow modification of the birth (creation) time using standard tools.
Prerequisites
To follow this guide, ensure:
- A Linux system (e.g., Ubuntu, Debian, CentOS)
- Terminal access with necessary permissions (
sudo
or root) - The
touch
command is available (default on all major distributions) - Understanding of the
touch
timestamp format
Timestamp Format:
[[CC]YY]MMDDhhmm[.ss]
Example:202404200101.00
→ April 20, 2024, at 01:01:00 AM
Steps to Modify File Date (Access and Modify Time)
1. Create a file
touch new.txt
2. Modify access and modification times
touch -a -m -t 202404200101.00 new.txt
3. Verify the changes
stat new.txt
Expected Output:
Access: 2024-04-20 01:01:00.000000000 +0000 Modify: 2024-04-20 01:01:00.000000000 +0000 Change: [current time] Birth: [unchanged, if supported]
Important Limitation: Birth Time
- Birth (creation) time cannot be changed using
touch
or most Linux utilities. - Most Linux filesystems (like
ext4
,xfs
,btrfs
) do not support birth time editing. - Even when visible, this field is read-only and primarily informational.
- Some environments may simulate birth time, but true modification is not possible with common tools.
Conclusion
Using the touch
command, you can manipulate mtime
and atime
to simulate past activity or modify metadata for auditing or testing purposes. However, modifying the birth timestamp is not supported due to limitations in Linux filesystem designs. For practical purposes, focus on mtime
and atime
, which are both fully controllable.