When was a file last opened

busybox the favorite of Embedded Linux systems.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. The utilities in BusyBox generally have fewer options than their full-featured GNU cousins; however, the options that are included provide the expected functionality and behave very much like their GNU counterparts. BusyBox provides a fairly complete environment for any small or embedded system.

BusyBox has been written with size-optimization and limited resources in mind. It is also extremely modular so you can easily include or exclude commands (or features) at compile time. This makes it easy to customize your embedded systems. To create a working system, just add some device nodes in /dev, a few configuration files in /etc, and a Linux kernel.

You can pretty much make any coreutil name a link to the busybox binary and it will work. you can also run busybox <command> and it will work. Example: if you're on Gentoo and haven't installed your vi yet, you can run busybox vi filename and you'll be in vi. It's

• Arch Linux - community/busybox

• Gentoo Linux - sys-apps/busybox

• Alpine Linux - based on BusyBox and uClibc, here's an overview

This depends on exactly what you mean by "opened", but in general, yes. There are three timestamps normally recorded:

• mtime — updated when the file contents change. This is the "default" file time in most cases.
• ctime — updated when the file or its metadata (owner, permissions) change
• atime — updated when the file is read

So, generally, what you want to see is the atime of a file. You can get that with stat or with ls. You can use ls -lu to do this, although I prefer to use ls -l --time=atime (which should be supported in almost all modern Linux distributions) because I don't use it often, and when I do I can remember it better. And to sort by time, add the -t flag to ls. So there you go.

There is a big caveat, though. Updating the atime every time a file is read causes a lot of usually-unnecessary IO, slowing everything down. So, most Linux distributions now default to the noatime filesystem mount option, which basically kills atimes, or else relatime, which only updates atimes once a limit has passed (normally once per day) or if the file was actually modified since the previous read. You can find if these options are active by running the mount command.

Also, note that access times are by inode, not by filename, so if you have hardlinks, reading from one will update all names that refer to the same file.

And, be aware that c is not "creation"; creation isn't tracked by Unix/Linux filesystems, which seems strange but actually makes sense because the filesystem has no way of knowing if it is the original — maybe the file was created forty years ago and copied here. And, in fact, many file editors work by making copies over the original. If you need that information, it's best to use a version control system like git.