Introduction
This guide explains how to modify file timestamps in Linux using touch, covering the difference between access time, modification time, and change time, along with a key limitation most tutorials skip: the file’s birth (creation) time generally can’t be changed at all.
Every file in Linux carries several timestamps as metadata:
- Access time (
atime) — the last time the file was read - Modification time (
mtime) — the last time the file’s content was changed - Change time (
ctime) — the last time the file’s metadata (permissions, ownership, etc.) was changed - Birth time — the file’s creation time, available only on certain filesystems and kernels
The touch command is commonly used to update the access and modification times — but as you’ll see below, Linux does not allow modification of the birth time using standard tools.
Implementation
I. Prerequisites
To follow this guide, make sure you have:
- A Linux system (Ubuntu, Debian, CentOS, or similar)
- Terminal access with the necessary permissions (
sudoor root, if working outside your own files) - The
touchcommand available (installed by default on all major distributions) - A basic understanding of the
touchtimestamp format
Timestamp format: [[CC]YY]MMDDhhmm[.ss]
Example: 202404200101.00 → April 20, 2024, at 01:01:00 AM
II. Create a Test File
touch new.txt
Running touch on a file that doesn’t exist creates an empty file and sets its access and modification times to the current time.
III. Modify File Timestamps Using touch
To set specific access and modification times:
touch -a -m -t 202404200101.00 new.txt
Here’s what each flag does:
| Flag | Purpose |
|---|---|
-a | Updates only the access time |
-m | Updates only the modification time |
-a -m (together) | Updates both access and modification time to the same value |
-t | Specifies the exact timestamp, in [[CC]YY]MMDDhhmm[.ss] format |
IV. Verify the Changes
stat new.txt
Expected output:
Access: 2024-04-20 01:01:00.000000000 +0000 Modify: 2024-04-20 01:01:00.000000000 +0000 Change: [current time] Birth: [unchanged, if supported]
Notice that Change still reflects the current time, not the value you set — this is expected, and explained below.
V. Understand the Birth Time Limitation
This is the part most guides gloss over: birth time cannot be changed using touch or most standard Linux utilities. A few reasons why:
- Most common Linux filesystems —
ext4,xfs,btrfs— either don’t expose birth time editing at all, or restrict it at the kernel level - Even when the
Birthfield is visible instatoutput, it’s read-only and purely informational - Some tools or environments may appear to “simulate” a birth time, but genuine modification isn’t possible with standard command-line utilities
Similarly, ctime (change time) is not directly settable by design — it’s automatically updated by the kernel any time a file’s metadata changes, including as a side effect of running touch itself. This is intentional: ctime exists specifically as a tamper-evidence mechanism, so allowing it to be freely set would defeat its purpose.
VI. Conclusion
Using touch, you can reliably modify mtime and atime to simulate past activity, backdate files for testing, or adjust metadata for specific auditing scenarios. Modifying the birth timestamp, however, isn’t supported due to how Linux filesystems are designed — and ctime updates automatically as a side effect of any metadata change, rather than being something you set directly. For practical day-to-day use, focus on mtime and atime, since those are the two timestamps you have full, reliable control over.
Frequently Asked Questions
Can I set atime and mtime to different values in the same command? Yes — run touch -t <timestamp> without -a or -m to set both to the same value, or run two separate touch commands with -a and -m individually if you need different values for each.
Why does ctime change even though I only modified atime and mtime? Because touch itself is a metadata-changing operation. The kernel automatically updates ctime any time a file’s inode metadata changes — including the very act of updating atime or mtime — which is why ctime can’t be set directly by design.
Is there any way to fake or set the birth time on Linux? Not reliably with standard tools. A small number of filesystem-specific or specialized utilities exist for niche use cases, but they aren’t part of standard Linux tooling and their behavior varies by filesystem, so they shouldn’t be relied on for general use.
Related Articles:
How the Linux Kernel Handles Network Connections Using DNS and Routing