I understand that ctime changes when the file metadata or the file content is changed and mtime on file content modification.
I would like to know the reason for updating ctime when the content of the file is changed, don't we have mtime tracking that already?
On my MAC
usxxkothan3m1:temp kothan3$ touch foo.txt
usxxkothan3m1:temp kothan3$ stat -x foo.txt
File: "foo.txt"
Size: 0 FileType: Regular File
Mode: (0644/-rw-r--r--) Uid: (276196474/ kothan3) Gid: (720748206/CORP\Domain Users)
Device: 1,4 Inode: 11745569 Links: 1
Access: Mon Aug 24 11:59:07 2015
Modify: Mon Aug 24 11:59:07 2015
Change: Mon Aug 24 11:59:07 2015
usxxkothan3m1:temp kothan3$ echo "write something here" >> foo.txt
usxxkothan3m1:temp kothan3$ stat -x foo.txt
File: "foo.txt"
Size: 21 FileType: Regular File
Mode: (0644/-rw-r--r--) Uid: (276196474/ kothan3) Gid: (720748206/CORP\Domain Users)
Device: 1,4 Inode: 11745569 Links: 1
Access: Mon Aug 24 11:59:24 2015
**Modify: Mon Aug 24 11:59:21 2015**
**Change: Mon Aug 24 11:59:21 2015**
usxxkothan3m1:temp kothan3$ chmod u-w foo.txt
usxxkothan3m1:temp kothan3$ stat -x foo.txt
File: "foo.txt"
Size: 21 FileType: Regular File
Mode: (0444/-r--r--r--) Uid: (276196474/ kothan3) Gid: (720748206/CORP\Domain Users)
Device: 1,4 Inode: 11745569 Links: 1
Access: Mon Aug 24 11:59:24 2015
Modify: Mon Aug 24 11:59:21 2015
**Change: Mon Aug 24 11:59:37 2015**
Best Answer
ctime
, or status change time, refers to the time when the file metadata has changed. For example,$ ls -ltc
under Linux will sort by and show the time of the last modification of file status information.To get a little deeper,
ctime
is the inode reported time since data blocks AND/OR the file metadata has changed. Changes in file metadata can refer here to such things as time elapsed since changes were made to the file name, file permissions, file attributes, SELinux contexts, and many other types of filesystem metadata relating to that specific file. Since thectime
field is updated whenever data blocks or metadata change, it is updated whenevermtime
is updated. If however the most recent changes to said file only involved metadata alteration, such as file renames,chmod
user-invoked permission changes, etc., then onlyctime
and notmtime
would be updated.A situation in which
ctime
has changed butmtime
has not, would clue you in to the fact that the file metadata has in some way been altered, but the underlying data comprising the file itself has not been altered. Useful for things like automated data backups, computer forensics, etc., I would imagine.