31

Using utimes, futimes, futimens, etc., it is possible to set the access and modification timestamps on a file.

Modification time is the last time the file data changed. Similarly, "ctime" or change time, is the last time attributes on the file, such as permissions, were changed. (Linux/POSIX maintains three timestamps: mtime and ctime, already discussed, and 'atime', or access time.)

Is there a function to set change timestamps? (Where "change" is the attribute modification or 'ctime', not modification time 'mtime'.) (I understand the cyclic nature of wanting to change the change timestamp, but think archiving software - it would be nice to restore a file exactly as it was.)

Are there any functions at all for creation timestamps? (I realize that ext2 does not support this, but I was wondering if Linux did, for those filesystems that do support it.)

If it's not possible, what is the reasoning behind it not being so?

Thanatos
  • 42,585
  • 14
  • 91
  • 146
  • Isn't touch command takes a parameter to do it ? – Madhur Ahuja Dec 27 '10 at 08:05
  • 1
    @Madhur Ahuja: He wants to know how to do it from a C program. – PleaseStand Dec 27 '10 at 08:19
  • 2
    @Madhur Ahuja: `touch` does not have a parameter (at least, my version does not or is not documented to have one) for changing *creation* or *change* times. `touch` will change modification or access times, however. – Thanatos Dec 27 '10 at 08:23
  • Strange, this page suggests otherwise: http://en.wikipedia.org/wiki/Touch_(Unix) – Madhur Ahuja Dec 27 '10 at 08:26
  • 1
    I see nothing on that page to indicate that `touch` has the capability to set change timestamps in any way. Note that I'm looking for *change* timestamps, which are a different beast from *modification* timestamps. I've tried to clarify my post on this point, if this is what is confusing. If it is not, what passage from that page gives you that suggestion? – Thanatos Dec 27 '10 at 08:36
  • 1
    Ok, Pardon my lack of knowledge in linux – Madhur Ahuja Dec 27 '10 at 08:37
  • 3
    @Madhur Ahuja: And pardon my unclear post. I will re-read it in a bit, to see if I can improve it once I've let myself get unfamiliar with it. – Thanatos Dec 27 '10 at 08:47
  • I'm also looking for this, but my use case is for a FUSE based file cache which should have the exact same mtime/ctime as the file it is caching. Doesn't look like it is possible without either modifying the kernel or changing system time (very bad). I suppose I'll store it in an extended attribute instead... – john16384 Oct 28 '17 at 11:11
  • Related: https://unix.stackexchange.com/questions/36021/how-can-i-change-change-date-of-file – Ciro Santilli OurBigBook.com Nov 11 '20 at 19:10

5 Answers5

31

For ext2/3 and possibly for ext4 you can do this with debugfs tool, assuming you want to change the ctime of file /tmp/foo which resides in disk /dev/sda1 we want to set ctime to 201001010101 which means 01 January 2010, time 01:01:

Warning: Disk must be unmounted before this operation

# Update ctime
debugfs -w -R 'set_inode_field /tmp/foo ctime 201001010101' /dev/sda1

# Drop vm cache so ctime update is reflected
echo 2 > /proc/sys/vm/drop_caches

Information taken from Command Line Kung Fu blog.

ismail
  • 46,010
  • 9
  • 86
  • 95
10

I had a similar issue, and wrote my answer here.

https://stackoverflow.com/a/17066309/391040

There are essentially two options:

  1. Slight change in kernel (code included in link)
  2. Change the system clock to the desired ctime, touch the file, then restore current time. (shell script for that included in link).
Community
  • 1
  • 1
Eitan
  • 1,308
  • 3
  • 15
  • 32
7

According to http://lists.gnu.org/archive/html/coreutils/2010-08/msg00010.html ctime cannot be faked (at least it's not intended to be fakeable):

POSIX says that atime and mtime are user-settable to arbitrary times via the utimensat() family of syscalls, but that ctime must unfakeably track the current time of any action that changes a file's metadata or contents.

If you just need to change a file's ctime for some testing/debugging, bindfs might be helpful. It's a FUSE filesystem which mounts one directory into another place, and can do some transformation on the file attributes. With option --ctime-from-mtime the ctime of each file is the same as its mtime, which you can set with touch -t.

oliver
  • 6,204
  • 9
  • 46
  • 50
  • 1
    And, I think I gather, Linux (/POSIX) has no concept of a file creation time? – Thanatos Jul 03 '13 at 02:47
  • I'm not experienced in that area; but according to http://unix.stackexchange.com/a/20464 the various standards don't require file creation time to be stored. Some filesystems store creation time anyway, and it can be accessed with nonstandard ways. – oliver Jul 10 '13 at 20:35
  • `ctime` is not create-time but file attributes' change-time. For example, the file size is such an attribute. Hence if you modify a file, `ctime` and `mtime` get altered. So backup tools can rely on `ctime`, as it cannot be faked (except if you warp the system time). – Tino Oct 21 '15 at 14:02
2

The easiest way:

1) change System time
2) copy paste a file on another location.

I tried this on windows 7 and I succeed to change all three timestamps. The stat command on linux shows that all three timestamps are changed.

SteP
  • 35
  • 7
1

The script below automates running debugfs ... set_inode_field ... ctime ... in ismail's answer for many files. It will copy ctime values from files in /media/MYUSER/MYFS/FOO/BAR (recursively) to /media/MYUSER/MYFS2/FOO/BAR, and umount /media/MYUSER/MYFS2 as a side effect. It will work only if the filesystem of /media/MYUSER/MYFS2 is ext2, ext3 or ext4 (because debugfs works only for these filesystems).

mydev2="$(df /media/MYUSER/MYFS2 | perl -ne '$x = $1 if !m@^Filesystem @ and m@([^ ]+) @; END { print "$x\n" }')"
cd /media/MYUSER/MYFS
find FOO/BAR -type f | perl -ne 'chomp; my @st = lstat($_); if (@st and -f(_)) { s@"@""@g; print "set_inode_field \"/$_\" ctime \@$st[10]\n" }' >/tmp/sif.out
sudo umount /media/MYUSER/MYFS2  # Repeat until success.
sudo debugfs -w -f /tmp/sif.out /dev/"$mydev2"

It handles filenames with whitespace and special characters correctly.

It works independently of time zones. As a limitation of debugfs, its precision is seconds, it ignores anything smaller (e.g. milliseconds, microseconds, nanoseconds). Depending the version of debugfs used, it may use 32-bit timestamps, thus it works correctly with dates before 2038-01-19.

If the current user doesn't have enough read permissions for /media/MYUSER/MYFS, then the commands above should be run as root (sudo bash).

pts
  • 80,836
  • 20
  • 110
  • 183