The Linux find command is a handy tool that lets you find or locate files on your system. You can specify to locate a file based on wide criteria such as file type, file location, and file permissions to mention a few. Additionally, you can find files changed in the last number of days. And this will be the focus of this tutorial and will explore various ways to retrieve files based on their timestamps.
Types of file timestamps
Files in Linux bear the following timestamps:
atime: This is the access timestamp and it reveals the last time a file was read or accessed. This implies an application was used to open the file and read its contents.
amin: This prints out when the file was accessed in minutes.
mtime: This is the modified timestamp. It reveals when a file was last modified either by a program or a user. The mtime changes when the file's contents are changed or modified. By 'modify' we mean that some data was appended to the file, reorganized or deleted partly or wholly.
mmin: The mmin directive reveals the last time a file was modified in minutes.
ctime: This is the change time or change timestamp. It reveals when the file's properties changed. A good example is modifying file ownership or permissions which effectively changes the timestamp.
That's a brief overview of the timestamps. Here we will focus more on the 'atime and 'mtime' timestamps.
Using Mtime - modification time
In this section, we will focus on how you can go about searching for files with timestamps that fall within a certain range using the mtime option. This lists files accessed days ago.
To list files whose timestamp changed in the last 90 days use the + mtime 90 option.
- - mtime +90 Implies that you are looking for a file changed more than 90 days ago.
- - mtime -90 Means that you are looking for a file changed less than 90 days ago.
- -mtime 90 Means you are looking for a file modified exactly 90 days.
For example, to search for txt files in the
/home/james/data directory that were modified less than 90 days ago use the following command:
$ find /home/james/data -iname "*.txt" -mtime -90 -print
Additionally, you can use numerical parameters as shown:
-1the last 24 hours
-0.5the last 12 hours
-0.25the last 6 hours
+2more than two days
For example, the following command displays text files modified in the last 12 hours
$ find /home/james/data -iname "*.txt" -mtime -0.5
Using atime - File access
As we have seen previously, atime is the attribute used for showing the last time a file was accessed by a user or an application. Let's check out a few examples:
To view all text files in the home directory accessed within the last 30 days, run
$ find /home/james -iname "*.txt" -atime -30 -type f
To view the docx files accessed precisely 20 days ago, run the command below. Note that there's no minus sign before the 20 value.
$ find /home/james -iname "*.docx" -atime 20 -type -f
The -daystart option
-daystart option measures the time from the start of the current day instead of 24 hours ago. For example. to find out all pdf files edited yesterday, run:
$ find /home/james/data/ -mtime 1 -daystart -iname "*.pdf"
To list the files edited between 3-5 days ago, run the command:
$ find /home/james/data/ -mtime 3 -mtime -5 -daystart -iname "*.pdf"
The -newer option
The -newer option compares files from two different directories and displays the files that are newer. For example, to find files that are newer in the
/home/james/Downloads directory than in the
/home/james/images directory, run the following command
$ find /home/james/Downloads -newer /home/james/images
This concludes our topic today where we looked at how to list files changed in the last number of days or accessed within a certain time duration. To get the last modified date of file you can use a few different commands in Linux.
Your feedback is most welcome.