Linux · file management

touch

make a file, or mark it as new

touch was written to update a file’s timestamps — to "touch" it without changing what is in it. If the file does not exist, it creates an empty one, and that side effect is what the command is mostly used for today.

On a file that exists it changes only the time; on one that does not, it makes an empty file of zero bytes.

Creates

An empty file

if the name is not there yet

Otherwise

Updates the times

access and modification

Contents

Never changed

safe on an existing file

Several at once

touch a b c

any number of names

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ touch notes.txt

$ ls -l notes.txt

1-rw-r--r-- 1 user user 0 Sep 30 11:02 notes.txt

2$ touch notes.txt

$ ls -l notes.txt

3-rw-r--r-- 1 user user 0 Sep 30 11:15 notes.txt

4$ touch -d "2026-01-01 09:00" notes.txt

$ ls -l notes.txt

-rw-r--r-- 1 user user 0 Jan 1 09:00 notes.txt

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

A new file, zero bytes long

The fifth column is the size: 0. touch printed nothing, as most commands do when they succeed.

The same command, a second time

The file exists now, so nothing is created. touch only sets its timestamps to the present moment.

Only the time moved

11:02 became 11:15. The size is still 0 and whatever the file held would be untouched.

-d sets a time of your choosing

The timestamp is just a value stored with the file, and anyone who may write to the file can set it to anything.

Switches

A switch changes how the command behaves. These are the ones used day to day; man touch lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-c: Do not create the file if it does not exist — only update one that does.
-a: Change only the access time.
-m: Change only the modification time.
-d STRING: Use the given date instead of now, for example -d "2026-01-01 09:00".
-r FILE: Use another file’s timestamps instead of now.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

touch a.txt b.txt c.txt

Creates several empty files in one command.

touch -c report.txt

Updates the time only if the file exists — never creates one by accident.

touch -r old.txt new.txt

Gives new.txt the same timestamps as old.txt.

stat notes.txt

Shows all three of a file’s times: access, modify and change.

In cybersecurity

A file’s modification time is a claim, not a record — touch can set it to any date, which matters whenever times are used as evidence.

Timestomping

An intruder sets a dropped file’s time to match its neighbours so it does not stand out in a listing sorted by date.

The change time is harder to fake

touch cannot set ctime, which the kernel updates itself. A modify time older than the change time is worth a second look; stat shows both.

Empty files as flags

Scripts often test whether a file exists as a switch. Know who can create files in that directory, or anyone can flip it.

Filed under

File management

Read alongside

mkdirCreates directories — one at a time, or a whole nested path in a single step with -p.lsLists the contents of a directory — names, and with -l the type, permissions, owner, size and date of each entry.