Linux ls -lt vs -ltu vs -ltc

Every file carries three timestamps, and ls sorts by whichever one you ask for:

Flag	Timestamp	Changes when
-lt	mtime	file contents are modified
-ltu	atime	file is read
-ltc	ctime	inode metadata changes (permissions, owner, rename, link count)

The one that trips people up is ctime: it is change time, not create time. Linux has no portable creation timestamp — stat may show Birth: on ext4, but it’s often blank.

Practical use: ls -ltc is how you spot a file whose permissions or ownership were touched without its contents changing. ls -ltu is mostly unreliable these days since most filesystems mount with relatime and only refresh atime once a day.