Setting creation or change timestamps

Question

Using utimes, futimes, futimens, etc., it is possible to set the access and modification timestamps on a file.

Modification ti

Answer 1

The easiest way:

1) change System time
2) copy paste a file on another location.

I tried this on windows 7 and I succeed to change all three timestamps. The stat command on linux shows that all three timestamps are changed.

Answer 2

For ext2/3 and possibly for ext4 you can do this with debugfs tool, assuming you want to change the ctime of file /tmp/foo which resides in disk /dev/sda1 we want to set ctime to 201001010101 which means 01 January 2010, time 01:01:

Warning: Disk must be unmounted before this operation

# Update ctime
debugfs -w -R 'set_inode_field /tmp/foo ctime 201001010101' /dev/sda1

# Drop vm cache so ctime update is reflected
echo 2 > /proc/sys/vm/drop_caches

Information taken from Command Line Kung Fu blog.

Answer 3

I had a similar issue, and wrote my answer here.

https://stackoverflow.com/a/17066309/391040

There are essentially two options:

1. Slight change in kernel (code included in link)
2. Change the system clock to the desired ctime, touch the file, then restore current time. (shell script for that included in link).

Answer 4

According to http://lists.gnu.org/archive/html/coreutils/2010-08/msg00010.html ctime cannot be faked (at least it's not intended to be fakeable):

POSIX says that atime and mtime are user-settable to arbitrary times via the utimensat() family of syscalls, but that ctime must unfakeably track the current time of any action that changes a file's metadata or contents.

If you just need to change a file's ctime for some testing/debugging, bindfs might be helpful. It's a FUSE filesystem which mounts one directory into another place, and can do some transformation on the file attributes. With option --ctime-from-mtime the ctime of each file is the same as its mtime, which you can set with touch -t.