The stat(2) structure keeps track of the entire file date / time:
struct stat { dev_t st_dev; ino_t st_ino; mode_t st_mode; nlink_t st_nlink; uid_t st_uid; gid_t st_gid; dev_t st_rdev; off_t st_size; blksize_t st_blksize; blkcnt_t st_blocks; time_t st_atime; time_t st_mtime; time_t st_ctime; };
st_atime is access time updated by read(2) calls (and probably also when open(2) opens a file for reading) - it is NOT updated when files are read through mmap(2) . (This is why I assume open(2) will mark the access time.)
st_mtime - time to change data, either through write(2) , or truncate(2) or open(2) for writing. (Again, it is NOT updated when files are written via mmap(2) .)
st_ctime - metadata modification time: when any of the other data in the struct stat changes.
You can change timestamps on files using utime(2) :
struct utimbuf { time_t actime; time_t modtime; };
Note. You can change the access time change time and (data). You can set any of them at any time, but ctime will be set to the current time - because you changed the metadata for the file.
There is no creation time in this structure, so it is impossible to know when the file was created directly from the system.
If you really need to know the creation time, you can narrow it down to a range by looking at your backups - assuming that the file you are interested in has been copied along with its metadata.
sarnold
source share