Find Files By Access, Modification Date / Time Under Linux or UNIX

by on January 17, 2007 · 43 comments· LAST UPDATED July 3, 2010

in , ,

I do not remember where I saved pdf and text files under Linux. I have downloaded files from the Internet a few months ago. How do I find my pdf or text files?

You need to use the find command. Each file has three time stamps, which record the last time that certain operations were performed on the file:

[a] access (read the file's contents) - atime

[b] change the status (modify the file or its attributes) - ctime

[c] modify (change the file's contents) - mtime

You can search for files whose time stamps are within a certain age range, or compare them to other time stamps.

You can use -mtime option. It returns list of file if the file was last accessed N*24 hours ago. For example to find file in last 2 months (60 days) you need to use -mtime +60 option.

  • -mtime +60 means you are looking for a file modified 60 days ago.
  • -mtime -60 means less than 60 days.
  • -mtime 60 If you skip + or - it means exactly 60 days.

So to find text files that were last modified 60 days ago, use
$ find /home/you -iname "*.txt" -mtime -60 -print

Display content of file on screen that were last modified 60 days ago, use
$ find /home/you -iname "*.txt" -mtime -60 -exec cat {} \;

Count total number of files using wc command
$ find /home/you -iname "*.txt" -mtime -60 | wc -l

You can also use access time to find out pdf files. Following command will print the list of all pdf file that were accessed in last 60 days:
$ find /home/you -iname "*.pdf" -atime -60 -type -f

List all mp3s that were accessed exactly 10 days ago:
$ find /home/you -iname "*.mp3" -atime 10 -type -f

There is also an option called -daystart. It measure times from the beginning of today rather than from 24 hours ago. So, to list the all mp3s in your home directory that were accessed yesterday, type the command
$ find /home/you -iname "*.mp3" -daystart -type f -mtime 1

Where,

  • -type f - Only search for files and not directories

-daystart option

The -daystart option is used to measure time from the beginning of the current day instead of 24 hours ago. Find out all perl (*.pl) file modified yesterday, enter:

find /nas/projects/mgmt/scripts/perl -mtime 1 -daystart -iname "*.pl"

You can also list perl files that were modified 8-10 days ago, enter:
To list all of the files in your home directory tree that were modified from two to four days ago, type:

find /nas/projects/mgmt/scripts/perl -mtime 8 -mtime -10 -daystart -iname "*.pl"

-newer option

To find files in the /nas/images directory tree that are newer than the file /tmp/foo file, enter:

find /etc -newer /tmp/foo

You can use the touch command to set date timestamp you would like to search for, and then use -newer option as follows

touch --date "2010-01-05" /tmp/foo
# Find files newer than 2010/Jan/05, in /data/images
find /data/images -newer /tmp/foo
 

Read the man page of find command for more information:
man find

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 43 comments… read them below or add one }

1 Alankar January 29, 2009 at 5:30 pm

Suppose I want to remove a set of file frm date say 1st Jan 2009 – 20 Jan 2009 in a specific Directory.
Let me know

Reply

2 sowmya April 29, 2009 at 10:59 am

How to create a directory called Red and under that Red directory i want to create a file called Hat. How please guide me as soon as possible

Reply

3 Anonymous June 14, 2010 at 5:14 am

Please use the following command :

mkdir Red

cd Red

Red/>mkdir Hat

cd Hat

Red/Hat>

Please let me know if this is clear

Thanks,
Prashanthini

r

Reply

4 Amol April 8, 2011 at 5:56 am

mkdir Red
cd Red
touch Hat

Reply

5 Taylor December 1, 2011 at 6:50 pm

mkdir -p Red/Hat

Reply

6 R Duke July 4, 2010 at 9:57 am

@sowya: to create a file ./Red/Hat when the directory “Red” doesn’t exist yet, use mkdir and touch:

mkdir Red
touch Red/Hat

Reply

7 webdesign June 26, 2009 at 8:21 am

Thx for the find examples ! they were very helpfull

Reply

8 dkalaluhi July 24, 2009 at 1:08 pm

Find examples were great…needed to use this to get a report on a shared drive…getting the output was a bit of a pain, until the resident guru came through:

Finds files older than 18months and newer than 24 months, cat’s the output to a CSV in the format:
/some/path/somewhere, size in bytes, Access Time, Modified Time

find /dir/dir -type f -mtime +540 -mtime -720 -printf \”%p\”,\”%s\”,\”%AD\”,|”%TD\”\\n > /dir/dir/output.csv

works nicely, and the mem usage wasn’t bad at all, need eclipse and birt though because of

Reply

9 Matabares October 5, 2009 at 2:50 pm

In aix 5.3 put -name instead -iname

Reply

10 Masonite2009 October 14, 2009 at 10:50 pm

I would like to display the date modified, the owner of the file, and the file size of the files that I have found using the find command. Is there a way to do that?

Reply

11 Bharadh April 18, 2012 at 11:36 pm

Pipe the find output to xargs and get the listing with modification timestamp
Example: find . -name foo | xargs ls -tl

Reply

12 mike October 16, 2009 at 10:02 am

the commands in the examples are not working for me, im trying to get the times a particular word file has been accessed on my computer in the last week so i tried to use the -atime example to see if it was accessed one day ago, i typed this into terminal:

find /home/you -iname “*.mp3″ -atime 01 -type -f

it didnt work, can anyone help me?

Reply

13 Amol April 8, 2011 at 6:01 am

find / -name “*.mp3″ -atime +01 -type f

use this command , it will surely work

Reply

14 ABhik February 23, 2010 at 8:28 pm

@Mike – Replace ” by ‘ and try.

Reply

15 Ken May 6, 2010 at 1:07 am

I’ve got this in my delicious bookmarks and use it often, thank you. For some reason on one of my computers I have to leave the word -print off the command or I get a message about paths must precede expression. Still…thank you for the page.

Reply

16 rduke15 June 6, 2010 at 12:15 pm

If you need a specific date range many days ago, it would be boring to calculate how many days ago it was exactly. Here is an example looking for files modified between May 9 2008 and May 13 2008, in /home:

touch –date “2008-05-09″ /tmp/after
touch –date “2008-05-13″ /tmp/before
find /home/ -type f -newer /tmp/after -not -newer /tmp/before

Reply

17 bhageerathan April 20, 2011 at 11:18 am

very helpful…:) thank you

Reply

18 Prashant October 17, 2011 at 10:51 am

good one

Reply

19 Pradip October 7, 2013 at 11:11 pm

Very helpful and clean!

Reply

20 john August 19, 2010 at 6:56 pm

-rw-rw-rw- 1 qmaster qmaster 294520 Aug 16 00:35 HSTD.191.807
-rw-rw-rw- 1 qmaster qmaster 525118 Aug 17 00:56 HSTD.191.808
-rw-rw-rw- 1 qmaster qmaster 698575 Aug 18 01:42 HSTD.191.809
-rw-rw-rw- 1 qmaster qmaster 829239 Aug 19 01:25 HSTD.191.810

I would like to copy to a directory one of the following files by using today’s date minus one. In other words when I execute my script I want yesterdays file.

any help would be appreciated.
John

Reply

21 Nick September 18, 2010 at 2:03 pm

This should do the trick -

find . -type f -iname ‘HSTD*’ -daystart -mtime 1 -exec cp {} /path/to new/dir/ \;

Nick

Reply

22 Thabiso December 8, 2010 at 10:18 am

Hi,

How do I list the files of only today’s date and dump them into some output file?

Reply

23 Michael December 31, 2010 at 7:23 pm

I have a new Linux server. CentOS 5.5. I want to know if their is any way to see exactly what files are added or changed or updated after I install a program. How can I do this?

Reply

24 vara June 19, 2011 at 9:40 am

i want find the files created or modified in particular date

Reply

25 rana June 30, 2011 at 7:05 am

plz tell me command for following :-

find all the files in current folder with modification time (modified in last 6 hrs and not modified in last 4hrs) with their name starting with k and they must be regular files and not directories finally delete them..

Reply

26 Jagan October 31, 2013 at 9:20 am

try below one..

find . -type f -name “k*.*” -mmin -360 -exec ls -l ‘{}’ ; | xargs -0 /bin/rm -f

Reply

27 Ash August 19, 2011 at 9:39 pm

How do i find a file based on the date input i give and move that file, a file with date before that and after that to a directory using find.
For Example: I want to find a file “identity_*” last modified on 17th Aug moved to a directory along with one modified on 18th Aug, 19th Aug.

Any inputs are highly appreciated

Reply

28 Evgeni January 20, 2012 at 10:50 pm

If a file is moved to trash bin, is its ctime modified ?

Reply

29 Deepak Kumar March 20, 2012 at 9:46 am

very usefull commands thanks for it.

Reply

30 estani April 5, 2012 at 9:32 am

the -daystart option examples are wrong, daystart should be defined before the time constraint. From the man page:

-daystart
Measure times (for -amin, -atime, -cmin, -ctime, -mmin, and -mtime) from the
beginning of today rather than from 24 hours ago. This option only affects
tests which appear later on the command line.

The previous example was ok though.

Reply

31 chandan June 28, 2012 at 8:07 pm

tmpwatch is also good tool.

Reply

32 VirtualRon September 4, 2012 at 9:31 pm

Just for fun. I have a large media server, and my kid is always asking if I have any new movies. So… I created a dir named “new”, and run the following script:

find /media/Movies -type f -mtime -30 -exec ln -s {} /media/Movies/New/ \;

so… she can just click in the “New” directory, and it shows all movies added in the past month. they’re links, so she can just click them to play, without having to browse categories.

Reply

33 mohan March 4, 2013 at 2:25 pm

Actually i have modified the creation date and time of a linux file using ‘touch command’, now i need the original date and time back. Is there any command to retrieve the same.

Reply

34 Sandeep March 12, 2013 at 11:51 am

How to find files access in last 1 hour. pls share some script.

Reply

35 VirtualRon March 12, 2013 at 6:02 pm

find / -mmin -60

Reply

36 GST March 28, 2013 at 5:13 pm

Hi,

I am currently using a script to shoot an email containing the list of all file names which are there on our FTP server for more than 30 minutes. Now I want to exclude one file which lands on the server around 21:00 ET and stays there till 03:00 AM ET, as it is scheduled to process at 3 AM ET. Thus, if I use the current script then it will shoot an email for it in those 6 hours also, which I dont want because it is irrelevant.

Could you please help?

Thanks,
Gurmeet

Reply

37 Pjack June 10, 2013 at 2:49 am

You have to add the daystart before mtime or no use.
find /nas/projects/mgmt/scripts/perl -mtime 8 -mtime -10 -daystart -iname “*.pl” =>
find /nas/projects/mgmt/scripts/perl -daystart -mtime 8 -mtime -10 -iname “*.pl”

Reply

38 Rahul Patil July 11, 2013 at 11:42 am

daystart and mtime sequence matter.

[code]
find /nas/projects/mgmt/scripts/perl -mtime 1 -daystart -iname "*.pl"
[/code]
it should be as:
[code]
find /nas/projects/mgmt/scripts/perl -daystart -mtime 1 -iname "*.pl"
[/code]

Reply

39 Thinker July 13, 2013 at 10:23 am

rw-rw-rw- 1 qmaster qmaster 294520 Aug 16 00:35 HSTD.191.807
-rw-rw-rw- 1 qmaster qmaster 525118 Aug 17 00:56 HSTD.191.808
-rw-rw-rw- 1 qmaster qmaster 698575 Aug 18 01:42 HSTD.191.809
-rw-rw-rw- 1 qmaster qmaster 829239 Aug 19 01:25 HSTD.191.810

How to find all files created in a specific month using a variable in the current directory without drilling down in the sub directories. . Then moving these files to a sub directory.

Reply

40 Jagan October 31, 2013 at 9:24 am

HI,

i have 10 servers in which logs are created and after every 1 day logs are zipped..so what i need is i want the files which are not modified last 24 hours….i know the files which are modified last 24 hours but i want to know the files which are not modified in last 24 hours..Please help..thanks in advance..

Thanks
Jagan

Reply

41 James GOodman April 3, 2014 at 10:09 pm

I want to identify files where the creation date is different from the modification date. Is there a way to do that using find?

Reply

42 Jokin August 9, 2014 at 1:50 am

If you have a couple of cofuginration files you need to edit to change a parameter. And you want to make sure you get them all.Then find is also very handy combined with xargsvi `find . -type f |xargs grep -l `

Reply

43 Betty August 9, 2014 at 3:09 am

I used above commands (with $sploitpattern), but it gave fliaed results I think. It reports 2 files:- one is MemcachedStore.php from package OpenID- one is module.audio.mp3.php from mediamanager plugin of TinymceNot sure which regex then.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , , , , , , , , , ,

Previous Faq:

Next Faq: