Cybersecurity Updates & Tools

touch Command in Linux: Create Files and Update Timestamps

The touch command in Linux does two things: it creates new empty files, and it updates the timestamps on existing files and directories. When run on a file that does not exist, it creates it. When run on an existing file, the file’s content is left unchanged but its timestamps are updated to the current moment.

How the touch Command Works in Linux

The syntax is:

bashtouch [OPTIONS] FILE...

If the file does not exist, touch creates it as an empty file. If it already exists, timestamps are updated without changing the content:

bashtouch file1

To create or update multiple files in one command:

bashtouch file1 file2 file3

Creating a file requires write permission on the parent directory. If the directory does not allow write access, you will see a permission denied error.

Prevent accidental file creation with -c. In scripts that should only update existing files, -c (no-create) skips creation silently when the file does not exist:

bashtouch -c file1

If file1 does not exist, touch does nothing — no error, no new file. This is important in automation where creating an unintended file would break downstream logic.

Understanding Linux File Timestamps: atime, mtime, and ctime

Every file in Linux has three timestamps. Use stat to view all three at once:

bashstat filename
  • atime (access time) — updated when the file is read or opened by any command or application, such as catgrep, or vim
  • mtime (modify time) — updated when the file’s content changes
  • ctime (change time) — updated whenever any metadata or content changes. Metadata includes permissions, ownership, and hard link count. ctime also updates whenever mtime updates, because a content change is itself a metadata event

ctime cannot be set directly. Only atime and mtime can be set with touch. The kernel manages ctime automatically as a record of when the file’s metadata last changed. Even when you pass a custom timestamp with -d, the kernel still updates ctime to the current time.

Note on noatime filesystems. Many modern systems mount filesystems with noatime or relatime to reduce disk writes on every file read. If touch -a does not seem to persist the access time change, check your mount options with findmnt. This is a filesystem-level setting, not a touch bug.

Update Specific Timestamps, Set Custom Times, and Manage Symlinks

Update only the access time:

bashtouch -a file1

Update only the modification time:

bashtouch -m file1

Note that using -m still causes the kernel to update ctime indirectly, since changing mtime is a metadata change.

Set a specific date and time with -d. The string can be as full or as partial as you need. Omitting the time defaults to midnight:

bashtouch -d '1 June 2018 11:02' file1touch -d '12 June' file1       # midnight on June 12 of the current year

Set a timestamp in numeric format with -t. The format is [[CC]YY]MMDDhhmm[.ss]:

bashtouch -t 06011102 file1        # June 1st, 11:02 of the current year

Copy timestamps from a reference file with -r. This is useful in scripts that need to preserve original timestamps after modifying or processing a file:

bashtouch -r file1 file2           # file2 gets the exact timestamps of file1

Modify the symlink itself with -h. By default, touch follows a symbolic link and updates the target file’s timestamps. Use -h to change the symlink’s own timestamps without affecting the target:

bashtouch -h symlink1

The touch command is simple in most use cases but gives precise control when needed. Use -c in scripts to avoid silent file creation, -r to preserve reference timestamps after processing, and check findmnt when atime updates do not persist. Leave a comment below if you run into any issues.