Linux: finding files modified or accessed at a certain time

The ‘find’ utility is quite handy when used with the proper parameters. Below is a few ways to find files/folders based on the time they were accessed or modified.

Example 1:

find /path/to/folder -type f -name “*.txt” -mtime -5

This will find ‘files’ (-type f) within the folder /path/to/folder (or one of its sub directories), whose name ends with ‘.txt’, and which were modified (mtime) less than 5 days ago

Example 2:

find /path/to/folder -type d -name “stat*” -mtime +10

This would find ‘directories’ (-type d) within the folder /path/to/folder (or one of its subdirectories), whose name starts with ‘stat’, and which were modified more than 10 days ago

Example 3:

find . -iname “*.pdf” -mtime +2 -mtime -7

This would help you find files or folders in the ‘current directory’ (.), whose name ends with ‘.pdf’ regardeless of the case of that suffix (e.g. example.PDf would be matched), which were modified more than 2 days and less than 7 days ago (i.e. between 3 to 6 days ago).

Example 4:

find / -type f -atime -5 -size +100k

This example makes use of atime, i.e. time of access (as opposed to mtime, which is the time the file was modified). The above command would help you find files in your entire system (/ being the system root, unless your shell is jailed), which were accessed less than 5 days ago, and which are at least 100 kbytes in size.
PS: if you do not specify the ‘b’, ‘k’, ‘m’, etc., the default would be blocks of 512 bytes. For instance, using +100 instead of +100k, means you’re looking for files sized at least 100*512=51200 bytes (50 kbytes).

More examples to be added…

Leave a Reply