The Unix/Linux shell command "find" is really useful for finding files on your computer. There are also graphical utilities for finding files, but sometimes it is easier to use the command line, or it’s simply not possible, eg if logged in to a remote server using SSH. This post looks at how to use the find utility to locate files based on the modification time eg looking for files that have been modified in the last 24 hours.
Basic usage
The basic usage of the "find" command is
find [path...] [expression]
where [path] is the path to start looking from (multiple paths can be specified) and [expression] is the search etc that is passed to the find command. For a comprehensive look at the various flags etc that can be passed to find use "man find" to read the manual page.
To search for files that have been modified in the last 24 hours, from the current working directory and all subdirectories, you would issue the following command:
find . -ctime 0 -type f
The "-type f" tells find to only locate files (ie not directories and other special file types) and the "-ctime 0" flag tells find to locate files that have been modified between now and 24 hours ago. -ctime is n*24 hours, so 0 means within the last 24 hours, 1 means between 24 and 48 hours ago, 2 means between 48 and 72 hours ago, etc.
To find all files modified between 24 and 48 hours ago, from the current working directory and all its subdirectories, you would do this:
find . -ctime 1 -type f
Using the -daystart flag
Note that the -daystart flag is not available on Mac OS X.
Using -ctime without other modifiers means that the modification time will be between now and 24 hours ago. This means that if the current time is 2pm, it will return the files that were modified between 2pm yesterday and 2pm today. You can use the -daystart flag to indicate that the time tests begin from the start of today rather than now.
Note that the -daystart flag only affects tests which appear later on the command line, so it needs to be at the start before the time test flags. If it was at the very end of the command then it won’t have any affect.
To find all the files that were modified yesterday from the current working directory and all of its subdirectories, using the find command line utility, you would do this:
find . -daystart -ctime 0 -type f
To find all the files that were modified two days ago, you would do this:
find . -daystart -ctime 1 -type f
Output from the find command
The find command simply outputs the list of the filenames, with absolute paths. The example below shows the output of the current working directory which contains some Linux ISO images and their md5sum files:
$ find . . ./SimplyMEPIS-CD_7.0-rel_32.iso ./SimplyMEPIS-CD_7.0-rel_64.iso ./SimplyMEPIS-CD_7.0-rel_64.iso.md5 ./SimplyMEPIS-CD_7.0-rel_32.iso.md5
By adding the "-ls flag" find will also show the filesizes etc as shown in the example output below. It needs to be put at the end after the other arguments otherwise it’ll return more than just the files specified by the search criteria.
$ find . -daystart -ctime 4 -ls -type f 2731441 693969 -rw-r--r-- 1 chris chris 709928960 Dec 24 14:33 ./SimplyMEPIS-CD_7.0-rel_32.iso 2731442 710081 -rw-r--r-- 1 chris users 726413312 Dec 24 16:45 ./SimplyMEPIS-CD_7.0-rel_64.iso
The above lists the find output in `ls -dils` format. To do it a different format you could do as in the following example, using ls to get the date and time of modification:
for f in `find . -daystart -ctime 4 -type f`; do ls -l $f; done -rw-r--r-- 1 chris chris 709928960 2007-12-24 14:33 ./SimplyMEPIS-CD_7.0-rel_32.iso -rw-r--r-- 1 chris users 726413312 2007-12-24 16:45 ./SimplyMEPIS-CD_7.0-rel_64.iso
This isn’t as efficient as simply adding the -ls argument to find, as it then does an "ls" for each file matched, but it does give you more control over the output.
