MacOS: how to get "Last opened" attribute of file? - swift

Question

In some files in OS exist "Last opened" attribute:
modified and opened attribute is possible to get by the following way:
//modified date
try? FileManager.default.attributesOfItem(atPath: url.path)[FileAttributeKey.modificationDate] as? Date
//creation date
try? FileManager.default.attributesOfItem(atPath: url.path)[FileAttributeKey.creationDate] as? Date
But how to get "Last opened" date?

Answer 1

AFAIK, there is no way to get the last time the file was opened. Instead, you have to get the last time it was last read, written or its directory entry was modified.
Leo's suggestion in comments for another answer to use URLResourceValues.contentAccessDate is probably the cleanest way, especially since you already have a URL, which is typically the case these days.
func lastAccessDate(forURL url: URL) -> Date?
{
return try? url.resourceValues(
forKeys: [.contentAccessDateKey]).contentAccessDate
}
You can also reach down into the BSD layer using the path:
import Darwin // or Foundation
func lastAccessDate(forFileAtPath path: String) -> Date?
{
return path.withCString
{
var statStruct = Darwin.stat()
guard stat($0, &statStruct) == 0 else { return nil }
return Date(
timeIntervalSince1970: TimeInterval(statStruct.st_atimespec.tv_sec)
)
}
}
I'm not 100% of the of the behavior of resourceValues if the URL specified is a symbolic link, but stat() will return information about the file system inode pointed to by the link. If you want information directly about the link itself, use lstat() instead. stat() and lstat() are the same otherwise.
I'm pretty sure that URLResourceValues.contentAccessDate uses either stat() or lstat() under the hood.
One thing to keep in mind is that the last access time is not the last time the file was opened, but rather the last time it was read. The the man page for stat says:
The time-related fields of struct stat are as follows:
st_atime Time when file data last accessed. Changed by the mknod(2), utimes(2) and read(2) system calls.
st_mtime Time when file data last modified. Changed by the mknod(2), utimes(2) and write(2) system calls.
st_ctime Time when file status was last changed (inode data modification). Changed by the chmod(2), chown(2), link(2), mknod(2), rename(2), unlink(2),
utimes(2) and write(2) system calls.
st_birthtime Time of file creation. Only set once when the file is created. This field is only available in the 64 bit inode variants. On filesystems where
birthtime is not available, this field is set to 0 (i.e. epoch).
There the man page is referring to the 32-bit member field names, but the same would apply to the 64-bit names, st_atimespec, st_mtimespec, st_ctimespec, and st_birthtimespec.
To appromixate the getting the last time a file was opened, you'd want to get the the latest of st_atimespec, st_mtimespec and maybe st_ctimespec if you also want to include include changes to the directory entry that don't modify the contents, such as renaming the file or setting its permissions. So you'd need something like this:
func lastReadOrWrite(forFileAtPath path: String) -> Date?
{
return path.withCString
{
var statStruct = Darwin.stat()
guard stat($0, &statStruct) == 0 else { return nil }
let lastRead = Date(
timeIntervalSince1970: TimeInterval(statStruct.st_atimespec.tv_sec)
)
let lastWrite = Date(
timeIntervalSince1970: TimeInterval(statStruct.st_mtimespec.tv_sec)
)
// If you want to include dir entry updates
let lastDirEntryChange = Date(
timeIntervalSince1970: TimeInterval(statStruct.st_ctimespec.tv_sec)
)
return max( lastRead, max(lastWrite, lastDirEntryChange) )
}
}
or using URLResourceValues
func lastReadOrWriteDate(forURL url: URL) -> Date?
{
let valKeys: Set<URLResourceKey> =
[.contentAccessDateKey, .contentModificationDateKey, .attributeModificationDateKey]
guard let urlVals = try? url.resourceValues(forKeys:valKeys)
else { return nil }
let lastRead = urlVals.contentAccessDate ?? .distantPast
let lastWrite = urlVals.contentModificationDate ?? .distantPast
// If you want to include dir entry updates
let lastAttribMod = urlVals.attributeModificationDate ?? .distantPast
return max(lastRead, max(lastWrite, lastAttribMod))
}
Of course, if some process simply opens a file and then closes it without reading or writing, that will go unnoticed, but then if it didn't read or write, does it matter that it opened the file?