Identifying files created or modified in the last N days can be essential in many scenarios. If you’re wondering how to find files modified in the last N number of days in Linux, sorting files by modification date is a traditional method but becomes inefficient with large file sets. A more efficient approach uses the find command to search for files based on specific time attributes like modification time or access time.
Table of Contents
- Method 1: Using the
-mtimeOption (Modification Time) - Method 2: Using the
-atimeOption (Access Time) - Method 3: Using the
-daystartOption - Method 4: Using the
-newerOption
Method 1: Using the -mtime Option (Modification Time)
The -mtime option of the find command is used to search for files based on their modification timestamp. This timestamp reflects the last time a file was modified, either by a user or a program. The -mtime option works in the following way:
-mtime +N : Lists files that were modified more than N days ago.
-mtime -N : Lists files that were modified less than N days ago.
-mtime N : Lists files that were modified exactly N days ago.
Syntax:
$> find -iname "" -mtime -print
-iname “
-mtime
-print : displays the matching files.
Example:
To find all text files in the /home/user/ directory that were modified in the last 2 days:
$> find /home/user/ -iname "*.txt" -mtime -2 -print
Method 2: Using the -atime Option (Access Time)
The -atime option is similar to -mtime, but instead of focusing on the last modification time, it searches based on the file’s last access time. This timestamp is updated when the file is read or accessed by an application.
-atime +N : Lists files that were last accessed more than N days ago.
-atime -N : Lists files that were last accessed less than N days ago.
-atime n : Lists files that were last accessed exactly N days ago.
Syntax:
$> -iname "" -atime -type f -iname “
-atime
-type f : Restricts the search to regular files.
Example:
To find all text files in /home/user/ that were accessed in the last 1 day:
$> find /home/user/ -iname "*.txt" -atime -1 -type f
Method 3: Using the -daystart Option
The -daystart option alters the calculation of file timestamps by considering the start of the current day, rather than the past 24 hours. That is, -daystart considers files between midnight to midnight time period rather than rolling back 24 hours from the current time. This can be particularly useful when you need to search based on time periods that begin at midnight today rather than a rolling 24-hour window.
Syntax:
To list files modified between N1 and N2 days ago:
$> find -mtime -mtime - -daystart -iname "" -mtime
-daystart : Ensures that the comparison starts from the beginning of the current day.
-iname “
Example:
To find all text files modified between 1 to 5 days ago in the /home/user/ directory:
$> find /home/user/ -mtime 1 -mtime -5 -daystart -iname "*.txt"
Method 4: Using the -newer Option
The -newer option compares files based on their timestamps, specifically the modification times. It allows you to compare files in one directory with another file (such as a reference file), displaying files that are newer than the reference file.
Syntax:
$> find -newer Example:
To find all files in /home/user/ that were modified more recently than file1.txt:
$> find /home/user/ -newer file1.txt
Using the find command along with the appropriate time-related options (-mtime, -atime, -daystart, and -newer), you can efficiently search for files that were modified, accessed, or have timestamps within a specified range. These options allow for flexible searches, helping users pinpoint files based on precise time attributes, such as the last N days.