Diferenças entre mtime ctime atime

Adaptado de um post do Quora.

O comando find pode parecer um pouco complicado se alguns conceitos não forem entendidos antes de sua utilização. Quando procuramos por arquivos com critérios de tempo é fundamental saber a diferença entre mtime, atime e ctime.

De maneira muito breve:

• mtime é o momento de modificação do conteúdo
• atime é o momento que o arquivo foi acessado (lido)
• ctime é o momento que o arquivo teve algum atributo modificado

mtime

mtime (modification time) indica o momento que o conteúdo do arquivo mudou. Mas atenção, somente alteração do conteúdo vai mudar o mtime. Mudanças nos atributos ou nos metadados não alteram o mtime, somente o ctime.

atime

atime atime (access time) is the timestamp that indicates the time that a file has been accessed. The file may have been opened by you, or may have been accessed by some other program or a remote machine. Anytime a file has been accessed, its access time changes.

ctime ctime (change time) is the timestamp of a file that indicates the time that it was changed. Now, the modification can be in terms of its content or in terms of its attributes. Whenever anything about a file changes (except its access time), its ctime changes.

Let me demonstrate it by the following example. On a Unix-like system, lets create a file and check its atime, mtime and ctime. We can see, all the timestamps are same.

Now, let us print its contents. Since the text file was blank, it didn’t print anything. But looking at its stats, we see the access time has changed, while the others remain unchanged.

Now, let us write something into the file. Notice how all of its timestamps have changed! Since the file had to be accessed to modify it, the atime has changed. And since the contents of the file changed, its mtime and ctime both changed.

Now, instead of contents, what happens if we change its attributes? Say, file permissions? We added the ‘execute’ permission to the file and see how its atime and ctime changes! As is obvious, to make any changes to the file, you have to access it. Hence the changes to atime. Also, since only the attributes were changed and not the contents, the ctime changed while mtime remained as it is.

In general, this is how the timestamps behave: mtime <= ctime <= atime