in macOS terminal, can I display the 'added date', the creation date, and last access timestamp of a file?

Question

In the macOS terminal, when I do ls -l SomeFile.txt it shows most of the file's properties including its last modification timestamp.

However in Finder, besides the 'Date Modified' there is also the 'Date Added' for each file, i.e. the timestamp when the file was added to the particular folder where it's in. Is there a way to read or display this within the shell?

Also as far as I understood this Added Date is different than the file's creation date? Is there also a way to get its creation timestamp?

Lastly, macOS also keeps track of when a file was last accessed (read), can I get that timestamp from the shell as well?

So for example:

1. I create a new file on December 1st.
2. I modify the file on December 2nd.
3. I open (read) the file on December 3rd.
4. I move the file to a different folder on December 4th.

I'm looking for one or more shell commands to get these four particular timestamps.

Answer 1

The command mdls (metadata list) might be what you are looking for.

mdls    -n kMDItemFSName \
        -n kMDItemContentCreationDate \
        -n kMDItemContentModificationDate \
        -n kMDItemDateAdded \
        -n kMDItemUsedDates \
           FILENAME

Answer 2

The table below shows the metadata attribute which corresponds to the Finder application list view column. The metadata attribute can be passed to the mdls command to get the appropriate date. However, the date is not with respect to the current location.

Finder List View Column	Metadata Attribute
Date Added	kMDItemDateAdded
Date Created	kMDItemContentCreationDate
Date Last Opened	kMDItemLastUsedDate
Date Modified	kMDItemContentModificationDate

The function given below outputs the Finder application dates for file names given as input. The dates are converted to the computers default location. This function was tested in both bash and zsh.

dates () {
  local d=() e=0 f="%+" i n x 
  d+=("Date Added=kMDItemDateAdded")
  d+=("Date Creation=kMDItemContentCreationDate")
  d+=("Date Last Opened=kMDItemLastUsedDate")
  d+=("Date Modified=kMDItemContentModificationDate")
  for n; do
    if [[ -e "$n" ]]; then
      printf "Name: %s\n" "$n"
      for i in "${d[@]}"; do
        x="$(mdls -name "${i#*=}" "$n")"
        if [[ $x == *\(null\) ]]; then
          x="--"
        else
          x="$(date -jf "%Y-%m-%d %H:%M:%S %z" "${x#* = }" +"$f")"
        fi
        printf "%-16s = %s\n" "${i%=*}" "$x"
      done
    else
      printf "dates: %s: No such file or directory\n" "$n" >&2
      e=1
    fi
  done
  return $e
}

Below is an example of use.

dates x.jpg bad.name mbr.bin

Example output is given below. Note that the file bad.name does not exist.

Name: x.jpg
Date Added       = Mon Dec 11 11:16:37 CST 2023
Date Creation    = Mon Oct  2 08:48:39 CDT 2023
Date Last Opened = Mon Dec 11 04:10:54 CST 2023
Date Modified    = Mon Dec 11 04:21:26 CST 2023
dates: bad.name: No such file or directory
Name: mbr.bin
Date Added       = Fri Apr  2 13:16:56 CDT 2021
Date Creation    = Fri Apr  2 13:16:56 CDT 2021
Date Last Opened = --
Date Modified    = Fri Apr  2 13:16:56 CDT 2021

To get the format for the dates to be exactly as shown in the Finder on my Mac, I needed to modify the output format. In other words, I needed to replace f="%+" in the dates function with the following.

f="%b %-e, %Y at %-l:%M %p"

The change in output is shown below.

Name: x.jpg
Date Added       = Dec 11, 2023 at 11:16 AM
Date Creation    = Oct 2, 2023 at 8:48 AM
Date Last Opened = Dec 11, 2023 at 4:10 AM
Date Modified    = Dec 11, 2023 at 4:21 AM
dates: bad.name: No such file or directory
Name: mbr.bin
Date Added       = Apr 2, 2021 at 1:16 PM
Date Creation    = Apr 2, 2021 at 1:16 PM
Date Last Opened = --
Date Modified    = Apr 2, 2021 at 1:16 PM

---

Note: While using Catalina 10.15.7 to do testing on APFS volumes, I found the mdls command can return the wrong "Date Added" for files which have more than one hard link. In other words, the command may return the "Date Added" for a different file hard linked to the same inode. This can happen even when the Finder application shows the correct "Date Added".

---

References

• How to convert a date string to the current time zone on the command line?

Answer 3

At least you can use POSIX -c or -u:

-c Use time when file status was last changed for sorting or printing.
-u Use time of last access, instead of time of last modification of the file for sorting (-t) or long printing (-l).

for example:

 ls -lc SomeFile.txt
 ls -lu SomeFile.txt