Atime

Atime, short for access time, is the timestamp of the last time a file or directory was read or executed. It is part of the file's inode on most Unix-like file systems and is exposed by system calls such as stat and by commands like ls and find.

On typical Unix-like systems, atime is stored as a timespec value (seconds and nanoseconds) in the inode, alongside other timestamps such as mtime (modification time) and ctime (status change time). Access time is updated when a file is read or executed; reading a directory also updates its atime. Metadata changes do not typically refresh atime, but they may affect ctime.

Updating atime can incur disk writes and affect performance, especially on heavy I/O or mechanical drives. To mitigate this, many systems offer mount options: noatime to disable atime updates, nodiratime to avoid directory atime updates, and relatime (often the default on Linux) which defers atime updates and refreshes them only under certain conditions, reducing write amplification while preserving reasonable behavior. Some older configurations use strictatime, which updates atime on every access.

Applications commonly observe atime for cache validation, recent-file lists, or when using search criteria (for example, find -atime). Tools such as stat reveal the atime, while ls -lu shows the last access time. Note that atime semantics differ from mtime (modification time, the content change) and ctime (metadata change); some newer file systems also expose birth time on certain devices, but this is not universal.