Difference between Unix mtime, ctime, atime

Unix keeps track of 3 types of timestamps with a confusion happening between ctime and mtime:

atime: stands for access time which is when the file was last read.

ctime: is the inode change time. When does the inode change, when you of course update a file, but also when you do things like changing the permissions of the file but not necessarily its contents.

mtime: is the modification time, so if you change the contents of the file, this time is updated. Keep in mind when you change the contents of a file and and save it, the inode gets updated as well for that file, so ctime always changes too.

Therefore, atime is when you last read a file, ctime and mtime can be different depending of if you just modified the inode or the contents of the file (which updates ctime as well).

Let's say you use backup software that only backs up files that have changes in the ctime. This means that if you had a file and you changed the permissions, but not its contents, the backup software would see this as an updated file and still back it up.

Let's say you had a file you're restoring from 2 years ago, and some backup programs are able to restore the mtime as well, so if today is 2007, the file would show up with a date of 2005 in the timestamp when you do an "ls -l". However, ctime would be today in 2007 because that's under system control, and as soon as you restored the file back, inodes changed, and ctime is current.

If you have a backup program that does not restore mtime, then that's okay since you can change the modification time with the "touch" command. For example if you need to change the date to Jan 11, 2005 12AM to file.txt, then you can go:

# touch -t 200501111200 file.txt

So mtime is the timestamp of a file, and ctime is kept by the system, and when mtime changes ctime always changes.