This guide explains how to modify file timestamps in Linux using touch<\/strong>, covering the difference between access time, modification time, and change time, along with a key limitation most tutorials skip: the file’s birth (creation) time generally can’t be changed at all.<\/p>\n\n\n\n Every file in Linux carries several timestamps as metadata:<\/p>\n\n\n\n The To follow this guide, make sure you have:<\/p>\n\n\n\n Timestamp format:<\/strong> Example:<\/strong> Running To set specific access and modification times:<\/p>\n\n\n\n Here’s what each flag does:<\/p>\n\n\n\n Expected output:<\/strong><\/p>\n\n\n\n Notice that This is the part most guides gloss over: birth time cannot be changed using Similarly, Using Can I set atime and mtime to different values in the same command?<\/strong> Yes \u2014 run Why does ctime change even though I only modified atime and mtime?<\/strong> Because \n
atime<\/code>)<\/strong> \u2014 the last time the file was read<\/li>\n\n\n\nmtime<\/code>)<\/strong> \u2014 the last time the file’s content was changed<\/li>\n\n\n\nctime<\/code>)<\/strong> \u2014 the last time the file’s metadata (permissions, ownership, etc.) was changed<\/li>\n\n\n\ntouch<\/code> command is commonly used to update the access and modification times \u2014 but as you’ll see below, Linux does not allow modification of the birth time using standard tools.<\/p>\n\n\n\n
\n\n\n\nImplementation<\/h2>\n\n\n\n
I. Prerequisites<\/h3>\n\n\n\n
\n
sudo<\/code> or root, if working outside your own files)<\/li>\n\n\n\ntouch<\/code> command available (installed by default on all major distributions)<\/li>\n\n\n\ntouch<\/code> timestamp format<\/li>\n<\/ul>\n\n\n\n[[CC]YY]MMDDhhmm[.ss]<\/code><\/p>\n\n\n\n202404200101.00<\/code> \u2192 April 20, 2024, at 01:01:00 AM<\/p>\n\n\n\nII. Create a Test File<\/h3>\n\n\n\n
touch new.txt\n<\/pre>\n\n\n\n
touch<\/code> on a file that doesn’t exist creates an empty file and sets its access and modification times to the current time.<\/p>\n\n\n\nIII. Modify File Timestamps Using touch<\/h3>\n\n\n\n
touch -a -m -t 202404200101.00 new.txt\n<\/pre>\n\n\n\n
Flag<\/th> Purpose<\/th><\/tr><\/thead> -a<\/code><\/td>Updates only the access time<\/td><\/tr> -m<\/code><\/td>Updates only the modification time<\/td><\/tr> -a -m<\/code> (together)<\/td>Updates both access and modification time to the same value<\/td><\/tr> -t<\/code><\/td>Specifies the exact timestamp, in [[CC]YY]MMDDhhmm[.ss]<\/code> format<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nIV. Verify the Changes<\/h3>\n\n\n\n
stat new.txt\n<\/pre>\n\n\n\n
Access: 2024-04-20 01:01:00.000000000 +0000\nModify: 2024-04-20 01:01:00.000000000 +0000\nChange: [current time]\nBirth: [unchanged, if supported]\n<\/pre>\n\n\n\n
Change<\/code> still reflects the current time, not the value you set \u2014 this is expected, and explained below.<\/p>\n\n\n\nV. Understand the Birth Time Limitation<\/h3>\n\n\n\n
touch<\/code> or most standard Linux utilities. A few reasons why:<\/p>\n\n\n\n\n
ext4<\/code>, xfs<\/code>, btrfs<\/code> \u2014 either don’t expose birth time editing at all, or restrict it at the kernel level<\/li>\n\n\n\nBirth<\/code> field is visible in stat<\/code> output, it’s read-only and purely informational<\/li>\n\n\n\nctime<\/code> (change time) is not directly settable<\/strong> by design \u2014 it’s automatically updated by the kernel any time a file’s metadata changes, including as a side effect of running touch<\/code> itself. This is intentional: ctime<\/code> exists specifically as a tamper-evidence mechanism, so allowing it to be freely set would defeat its purpose.<\/p>\n\n\n\nVI. Conclusion<\/h3>\n\n\n\n
touch<\/code>, you can reliably modify mtime<\/code> and atime<\/code> to simulate past activity, backdate files for testing, or adjust metadata for specific auditing scenarios. Modifying the birth timestamp, however, isn’t supported due to how Linux filesystems are designed \u2014 and ctime<\/code> updates automatically as a side effect of any metadata change, rather than being something you set directly. For practical day-to-day use, focus on mtime<\/code> and atime<\/code>, since those are the two timestamps you have full, reliable control over.<\/p>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
touch -t <timestamp><\/code> without -a<\/code> or -m<\/code> to set both to the same value, or run two separate touch<\/code> commands with -a<\/code> and -m<\/code> individually if you need different values for each.<\/p>\n\n\n\ntouch<\/code> itself is a metadata-changing operation. The kernel automatically updates ctime<\/code> any time a file’s inode metadata changes \u2014 including the very act of updating atime<\/code> or mtime<\/code> \u2014 which is why ctime<\/code> can’t be set directly by design.<\/p>\n\n\n\n