What are atime, ctime and mtime?

Files, directories, fifos, sockets and device files (later on refered as files) has three different time values. Normally no-one is interested of these time values, but when something strange happens people tend look up when something happened and then you need to understand what are these times.

ctime. Many times this is understood as a creation time but that wrong. Ctime is change time of file stats such as ownership, what permissions it has etc.

mtime. File modification time. Value of mtime is updated when content of file changes.

atime. File access time. Value of atime is modified when file is opened.

As said above no-one is interested of these file times. all thou you can catch possible system cracker by checking file mtime and ctimes of binaries and important files. If you are unlucky system cracker knows how to use touch and time values are same as they where before. Then you need real file integrity checker to catch intruder.

All three time values are implemented in normal file systems, but if you mount some exotic file system you cannot be sure that they all present, see your documentation for more info about this. Note that there are file systems that you can mount so that atime will not ever get modified. With this file system feature you can gain better performance in some situations. See your documentations does your file system has this feature.

With this file statistics program stat.c you can check time values and other things about files.