It is impossible to avoid file creation and modification of OS routines under Linux file management. Every time a user logs into a Linux operating system environment, it is almost a surety or guarantee that we are going to create, modify, or create and modify several files.
Linux makes it possible to find the age and modification time associated with a targeted file. So how does finding a file’s age and modification time help us? Well, for users who want to be thorough with every file footprint associated with their Linux operating system, this article guide is for you.
Also, for users that are interested in career paths related to system auditing, determining the age and modification time associated with an existing file is a priceless skill.
File Timestamps in Linux
During the file creation process in Linux, a file’s metadata is associated with three distinct timestamps. When a created file is accessed or modified, these three timestamps subsequently change.
It is also important to note that the Extended File System (EXT); primarily linked with the Linux Kernel, does not permit file-creation timestamps. Let us closely look at these three distinct timestamps.
File Modified Time in Linux
The modified timestamp determines the actual time a file’s data or content was changed. The modification time is updated each time a file’s content is edited and saved.
The Linux ls -l command can help us determine a file’s modified time.
$ ls -l SystemLog.txt
If we modify the above file and run the ls -l command again, we should see a new/updated modified date and time as depicted in the screen capture below.
File Accessed Time in Linux
If you want to determine the last time a file was read, then we need to get the accessed timestamp. Please note that this metadata only points to when a file is referenced/read without any modification taking place on its metadata or content.
Here, we can use the Linux ls -lu command.
$ ls -lu SystemLog.txt
If we read this file using the cat command and run the above command again, the accessed time should change.
$ cat SystemLog.txt $ ls -lu SystemLog.txt
File Changed Time in Linux
The changed timestamp is associated with the time changes were made to a file’s metadata. For instance, if we change the filename or file permission, we can determine the changed time using the ls -lc command.
$ ls -lc SystemLog.txt
Let us rename the file and check the changed time again.
$ mv SystemLog.txt systemlog.txt $ ls -lc systemlog.txt
How to Find Files Modified, Accessed, and Changed Time Using Find Command
The find command makes it possible to search for files modified, accessed, and changed within a user-specified duration.
Finding Modified Files in Linux
For instance, we could search our Home directory for files modified within the last hour in the following manner:
$ find ~ -mmin 60
Finding Accessed Files in Linux
We could also find accessed files in the last 20 minutes:
$ find ~ -amin 20
Finding Changed Files in Linux
We could also find changed files that have aged more than an hour ago.
$ find ~/Linuxshelltips -cmin +60
Find Age of a File in Linux
Consider the following bash script that makes use of Linux’s date utility to determine the age of a file.
#!/bin/sh [ "$#" -eq 0 ] && echo "Usage: file-age <file>" && exit 1 filepath=$1 echo "$(basename $filepath): $(($(date +%s) - $(date -r "$filepath" +%s))) seconds"
Save the script file and make it executable.
$ chmod u+x file-age
To determine the age of a file, we have to specify the filename as an argument in the following manner.
$ ./file-age systemlog.txt
The screen capture above concludes that the file systemlog.txt was born/created 3661 seconds ago.
We should now be able to comfortably determine the accessed time, changed time, modification time, and age of any file on our Linux system. Hope this article was useful. Feel free to leave a comment or feedback.
