How to modify 'last status change' (ctime) property of a file in Unix?

Question

I know there's a way to modify both 'modification' (mtime) and 'last access' (atime) time properties of a given file in Unix System by using "touch" command. But I'm wondering whether there exists a way to modify "Last status change" (ctime) property, as well?

Answer 1

ctime is the time the file's inode was last changed. mtime is the last time the file's CONTENTS were changed. To modify ctime, you'll have to do something to the inode, such as doing a chmod or chown on the file.

Changing the file's contents will necessarily also update ctime, as the atime/mtime/ctime values are stored in the inode. Modifying mtime means ctime also gets updated.

Answer 2

Use the "utime" system call. If you look up its manpage there will also be utimes, having microsecond resolution, and a link to utimensat that has nanosecond resolution.

Any change to the inode like such a change to the times will set the "ctime" to the current time, so setting ctime to something in the past would immediately flip it back to the present. They realized this a long time ago, so there is no interface to set ctime.

This also helps maintain the integrity of the system: you can mess around with atime and mtime, but ctime is maintained by the system. (A hacker might for example modify your /bin/login to allow him access even if you remove his /etc/passwd entry. You spot him because of the unusual mtime on the file. Next time he changes the mtime back to when the system was installed, but he can't hide the ctime!).