How to Check a File’s Age and Modification Time in Linux

It is impossible to avoid file creation and modification of OS routines under Linux file management. Every time a user logs into a Linux operating system environment, it is almost a surety or guarantee that we are going to create, modify, or create and modify several files.

Linux makes it possible to find the age and modification time associated with a targeted file. So how does finding a file’s age and modification time help us? Well, for users who want to be thorough with every file footprint associated with their Linux operating system, this article guide is for you.

Also, for users that are interested in career paths related to system auditing, determining the age and modification time associated with an existing file is a priceless skill.

File Timestamps in Linux

During the file creation process in Linux, a file’s metadata is associated with three distinct timestamps. When a created file is accessed or modified, these three timestamps subsequently change.

It is also important to note that the Extended File System (EXT); primarily linked with the Linux Kernel, does not permit file-creation timestamps. Let us closely look at these three distinct timestamps.

File Modified Time in Linux

The modified timestamp determines the actual time a file’s data or content was changed. The modification time is updated each time a file’s content is edited and saved.

The Linux ls -l command can help us determine a file’s modified time.

$ ls -l SystemLog.txt 
Find File Modification Time
Find File Modification Time

If we modify the above file and run the ls -l command again, we should see a new/updated modified date and time as depicted in the screen capture below.

Check File Modification Time
Check File Modification Time

File Accessed Time in Linux

If you want to determine the last time a file was read, then we need to get the accessed timestamp. Please note that this metadata only points to when a file is referenced/read without any modification taking place on its metadata or content.

Here, we can use the Linux ls -lu command.

$ ls -lu SystemLog.txt  
Check File Access Time
Check File Access Time

If we read this file using the cat command and run the above command again, the accessed time should change.

$ cat SystemLog.txt
$ ls -lu SystemLog.txt
Find File Access Time
Find File Access Time

File Changed Time in Linux

The changed timestamp is associated with the time changes were made to a file’s metadata. For instance, if we change the filename or file permission, we can determine the changed time using the ls -lc command.

$ ls -lc SystemLog.txt
Find File Change Time
Find File Change Time

Let us rename the file and check the changed time again.

$ mv SystemLog.txt systemlog.txt
$ ls -lc systemlog.txt
Check File Change Time
Check File Change Time

How to Find Files Modified, Accessed, and Changed Time Using Find Command

The find command makes it possible to search for files modified, accessed, and changed within a user-specified duration.

Finding Modified Files in Linux

For instance, we could search our Home directory for files modified within the last hour in the following manner:

$ find ~ -mmin 60
Find Files Modified Last Hour
Find Files Modified Last Hour

Finding Accessed Files in Linux

We could also find accessed files in the last 20 minutes:

$ find ~ -amin 20
Find Files Accessed Time
Find Files Accessed Time

Finding Changed Files in Linux

We could also find changed files that have aged more than an hour ago.

$ find ~/Linuxshelltips -cmin +60
Find File Changed Time
Find File Changed Time

Find Age of a File in Linux

Consider the following bash script that makes use of Linux’s date utility to determine the age of a file.

#!/bin/sh
[ "$#" -eq 0 ] && echo "Usage: file-age <file>" && exit 1
filepath=$1
echo "$(basename $filepath): $(($(date +%s) - $(date -r "$filepath" +%s))) seconds"

Save the script file and make it executable.

$ chmod u+x file-age

To determine the age of a file, we have to specify the filename as an argument in the following manner.

$ ./file-age systemlog.txt
Find Age of File in Linux
Find Age of File in Linux

The screen capture above concludes that the file systemlog.txt was born/created 3661 seconds ago.

We should now be able to comfortably determine the accessed time, changed time, modification time, and age of any file on our Linux system. Hope this article was useful. Feel free to leave a comment or feedback.

Got something to say? Join the discussion.

Have a question or suggestion? Please leave a comment to start the discussion. Please keep in mind that all comments are moderated and your email address will NOT be published.