The date listed by ls is specifically the modification time, abbreviated as ‘mtime’ on UNIX-like systems such as Linux, of the file or directory. This timestamp gets updated whenever the data of the filesystem object is modified.
For a file, the meaning of that statement is relatively obvious, the mtime changes to the current time whenever the file is written to.
For a directory though, the meaning of ‘data’ is somewhat less obvious. The ‘data’ of a directory is the set of directory entries for that directory, which is functionally a list of the filesystem objects (and their names) that are in that directory. This means that creating, removing, or renaming a file in a directory will update the directory’s mtime (though changing permissions on such a file will not, because the permissions are part of the filesystem object, not part of the directory entry).
‘Creation’ time is a different concept on UNIX-like systems, and is actually somewhat tricky. All Linux filesystems provide two additional timestamps aside from the mtime:
- ctime (‘change time’), which tracks the last modification of certain metadata of the file. This includes permissions, security labels, ACLs, xattrs, and notably all the other timestamps. ctime is not usually exceptionally useful for regular users, but can be very useful for sysadmins to audit when changes happened.
- atime ('access time'), which tracks the last time that a file was accessed. This is updated any time the mtime would be updated, but also any time that data is read from the file. This one also behaves a bit unexpectedly with directories in that traversing a directory (accessing a file under that directory) does not update it, but listing the contents of the directory does. Very few things actually use atime these days because it’s trivial to spoof, and it is becoming increasingly normal to actually turn off tracking of it when mounting filesystems to cut down on disk writes.
Additionally, some filesystems provide a fourth timestamp referred to as the ‘btime’ or ‘birth time’ of the filesystem object, and it only gets set when a filesystem object is first created. This is the closest thing you can get to the creation time for a filesystem object, but it also behaves in a non-obvious way because of how the system itself works. In particular, many things on Linux do not rewrite files in-place, they instead write out a temporary file with any changes, and then rename it over top of the existing file (this is done to ensure that either all of the changes happen, or none of them happen). However, this creates a new filesystem object which replaces the old one, so it is not unusual for the btime on files to match the mtime.
