Checking a File’s Age and Modification Time

1. Overview

In this tutorial, we’ll cover how we can check a file’s age and modification time in Linux. First of all, we’ll go through the different timestamps of a file provided by Linux’s EXT file system. Afterward, we’ll cover the various methods and utilities that we can use to check a file’s modification time and its age relative to modification time.

2. Different Timestamps of a File in Linux

When creating a file on Linux, three distinct timestamps are attached to a file’s metadata. These timestamps are changed when we access or make modifications to the file. Currently, there is no file-creation timestamp on the Extended File System (EXT), which is specifically developed for the Linux kernel. For that reason, we’ll use modification time or changed time to filter files based on age. So, the age will be relative to the modification time.

For other filesystems that support the creation time of a file, there are commands, such as stat, that we can use for that purpose.

2.1. Modified Time

The modified timestamp contains the time the file’s data has been changed. It means when we make changes to the actual contents of the file, the file system will update the modification time.

We can check the modified time by running ls with the -l option:

$ ls -l
-rwxr-xr-x 1 hey hey 20879 Dec 12 21:44 README.md

2.2. Accessed Time

The accessed timestamp contains the timestamp for when the file was last read. In other words, the file was referenced, but the contents and metadata were not modified. We should also know that the file’s accessed time will also be updated if we modify the file’s contents because making modifications to a file requires accessing the file first.

We can view the access time for a file by using the -u option with the ls command:

$ ls -lu
-rwxr-xr-x 1 hey hey 20879 Dec 12 21:50 README.md

2.3. Changed Time

The changed timestamp contains the time the file’s metadata was changed. For instance, if we change the permissions for the file or change its filename, the file system will update its changed time.

We can pass the -c option to ls to show the changed time:

$ ls -lc
-rwxr-xr-x 1 hey hey 20879 Dec 12 21:57 README.md

3. Using the find Tool

We can search for files based on their modified, accessed, or changed time using the find tool with the -mmin, -amin, and -cmin options, respectively, for these timestamps. We can use find in our shell scripts because it makes it easier to find files based on the timestamps in the Linux file hierarchy compared to the other tools.

Let’s find some files in our home directory that have been modified in the past hour:

$ find ~ -mmin 60
./github/libri
./github/libri/README.md

Similarly, we can also filter out files based on their accessed time. Let’s see which files have been accessed in the past 10 minutes:

$ find ~ -amin 10
./libri/.git/objects/bf
./libri/.git/logs
./libri/.git/logs/refs
./libri/.git/logs/refs/remotes
...

Or we can find files based on their changed time. In this case, let’s look for files that were changed more than an hour ago:

$ find ~ -cmin +60
./libri
./libri/README.md

4. Using the date Utility to Find the Age of a File

We can get a more fine-grained timestamp for a file’s modified time using the date utility. We can make use of the -r or –reference option of the date utility to specify a file:

$ date -r ./README.md "+%s"
1639330559

The last argument to the date command is the format in which the timestamp is printed. In our case, we’re telling the date to print the time in seconds since the UNIX Epoch, which was midnight 00:00:00 on January 1, 1970, in UTC. All the file timestamps are stored in the UNIX Epoch format, which we can use to create different time and date formats.

To get the Epoch for the current time, we can simply use the date command followed by the Epoch format:

$ date +%s
1639332063

We can use this number to find the age of a file by subtracting the file’s modified Epoch from the current Epoch:

#!/bin/sh

[ "$#" -eq 0 ] && echo "Usage: file-age <file>" && exit 1
filepath=$1

echo "$(basename $filepath): $(($(date +%s) - $(date -r "$filepath" +%s))) seconds"

The script expects a file as an argument. So, let’s feed it one and check it out:

$ ./file-age ./README.md
README.md: 958 seconds

5. Using the stat Command

As an alternative to the date command, we can also use the stat command. The stat command prints out information about files and file systems.

Let’s see it in action:

$ stat README.md
  File: README.md
  Size: 20879     	Blocks: 48         IO Block: 4096   regular file
Device: 8,3	Inode: 17301783    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: ( 1000/     hey)   Gid: ( 1000/     hey)
Access: 2021-12-12 19:56:47.653310645 +0500
Modify: 2021-12-12 22:35:59.056320075 +0500
Change: 2021-12-12 22:35:59.056320075 +0500
 Birth: -

As we can see, it prints a lot of extra information about the file. We can also notice the Birth field in the above output, which should imply the creation time of the file. Although it should work on other file systems that support the birth time for a file, it’s not supported on the EXT file system.

On other file systems such as ZFS, BTRFS, and XFS, we can check for a file’s birth time:

$ stat -c %w /mnt/zfs_drive/test.txt
2021-12-12 23:30:00.190003029 +0500

The -c option specifies the format. In our case, we passed the %w argument to the option, which signifies human-readable birth time.

Moreover, we can also print the modified timestamp since the Epoch using the %Y format:

$ stat -c %Y README.md
1639330559

For a complete list of the formats, we can refer to the stat man page.

6. Using perl

Every Linux distribution comes with perl installed. We can use a one-liner perl command to get the modification age of a file:

$ perl -l -e 'print -M $ARGV[0], " days"' "/etc/ftab"
82.8740162037037 days

Let’s break it down:

• The -l command enables line-endings
• The -e command executes the one-liner inside the single quotes
• The -M option to print tells it to print the modification time of the file in days
• The last argument to the perl command is the file we want to process

7. Conclusion

In this article, we went through the access, modification, and changed times of a file in Linux. We covered the different tools and utilities that we can use to check the age or modification time of a file.