Linux: Find Files By Date

in Categories , , , , last updated November 27, 2017

How do I find files by date under UNIX and Linux system? How search for files that created on a specific date on Linux or Unix-like system?

Linux and UNIX like operating systems do not store file creation time. However, you can use file access and modification time and date to find out file by date.
How to use 'find' to search for files created on a specific date?
You need to use the NA command and NA command.

ls Command Example

The syntax is as follows:

ls -l  
ls -lt
ls -ltu
ls -lt /etc/ | more

Sample outputs:

drwxr-xr-x 2 root root    4096 Sep 24 11:42 sysctl.d
drwxr-xr-x 2 root root    4096 Sep 24 11:42 logrotate.d
drwxr-xr-x 2 root root    4096 Sep 24 11:42 init
drwxr-xr-x 2 root root    4096 Sep 24 11:42 init.d
drwxr-xr-x 2 root root    4096 Sep 24 11:42 dnsmasq.d-available
drwxr-xr-x 2 root root    4096 Sep 23 06:22 bash_completion.d
-rw-r--r-- 1 root root   22667 Sep 22 18:17 ld.so.cache
drwxr-xr-x 9 root root    4096 Sep 22 18:17 apparmor.d
drwxr-xr-x 2 root root    4096 Sep 21 06:21 ssh
drwxr-xr-x 2 root root    4096 Sep 20 05:35 python3.5
-rw-r--r-- 1 root root    3611 Sep 20 05:35 mailcap
drwxr-xr-x 3 root root    4096 Sep 13 12:29 apparmor
drwxr-xr-x 7 root root    4096 Aug 22 21:07 network
-rw-r--r-- 1 root root     929 Aug 22 21:07 resolv.conf
-rw-r--r-- 1 root root     492 Aug 22 21:07 fstab
drwxr-xr-x 2 root root    4096 Aug 22 16:31 cron.hourly
drwxr-xr-x 2 root root    4096 Aug 22 16:29 percona-toolkit
drwxr-xr-x 2 root root    4096 Aug 22 16:29 gdb
drwxr-xr-x 2 root root    4096 Aug 18 21:28 cron.daily
...
..
...
-rw-r--r-- 1 root root     575 Oct 22  2015 profile
-rw-r--r-- 1 root root   10368 Oct  2  2015 sensors3.conf
-rw-r--r-- 1 root root    2188 Aug 31  2015 bash.bashrc
-rw-r--r-- 1 root root      45 Aug 12  2015 bash_completion
-rw-r--r-- 1 root root     477 Jul 19  2015 zsh_command_not_found
-rw-r--r-- 1 root root     604 Jul  2  2015 deluser.conf
-rw-r--r-- 1 root root    3663 Jun  9  2015 screenrc
-rw-r--r-- 1 root root     703 May  6  2015 logrotate.conf
-rw-r--r-- 1 root root      12 Apr 30  2015 debian_version
-rw-r--r-- 1 root root     771 Mar  6  2015 insserv.conf
drwxr-xr-x 2 root root    4096 Mar  6  2015 insserv.conf.d
-rw-r--r-- 1 root root     338 Nov 18  2014 updatedb.conf
-rw-r--r-- 1 root root     346 Nov  6  2014 discover-modprobe.conf
-rw-r--r-- 1 root root    2932 Oct 25  2014 protocols
-rw-r--r-- 1 root root     887 Oct 25  2014 rpc
-rw-r--r-- 1 root root   19605 Oct 25  2014 services
-rw-r--r-- 1 root root     280 Jun 20  2014 fuse.conf
-rw-r--r-- 1 root root     497 May  4  2014 nsswitch.conf

You need to use the grep command/egrep command to filter out info:
$ ls -lt /etc/ | grep filename
ls -lt /etc/ | grep 'Jun 20'

A better and recommended solution is the find command:
find . -type f -ls |grep '2017'
find . -type f -ls |grep 'filename'
find /etc/ -type f -ls |grep '25 Sep'

find Command Example

If you need a specific date range many days ago, than consider using the find command. In this example find files modified between Jan/1/2007 and Jan/1/2008, in /data/images directory:

touch --date "2007-01-01" /tmp/start
touch --date "2008-01-01" /tmp/end
find /data/images -type f -newer /tmp/start -not -newer /tmp/end

You can save list to a text file called output.txt as follows:
find /data/images -type f -newer /tmp/start -not -newer /tmp/end > output.txt

Say hello to -newerXY option for find command

The syntax is as follows:
find /dir/ -type f -newerXY 'yyyy-mm-dd'
find /dir/ -type f -newerXY 'yyyy-mm-dd' -ls

The letters X and Y can be any of the following letters:

  1. a – The access time of the file reference
  2. B – The birth time of the file reference
  3. c – The inode status change time of reference
  4. m – The modification time of the file reference
  5. t – reference is interpreted directly as a time

To see all files modified on the 24/Sep/2017 in the current directory:

find . -type f -newermt 2017-09-24
## pass the -ls option to list files in ls -l format ##
find . -type f -newermt 2017-09-24 -ls

OR
find . -type f -newermt 2017-09-24 ! -newermt 2017-09-25
find . -type f -newermt 2017-09-24 ! -newermt 2017-09-25 -ls

Sample outputs:

      956      4 -rw-r--r--   1 root     root          910 Sep 24 11:42 ./init.d/.depend.boot
      958      4 -rw-r--r--   1 root     root          876 Sep 24 11:42 ./init.d/.depend.start
      959      4 -rw-r--r--   1 root     root          783 Sep 24 11:42 ./init.d/.depend.stop

To see all files accessed on the 25/Sep/2017:

$ find . -type f -newerat 2017-09-25 ! -newerat 2017-09-26
OR
$ find . -type f -newerat 2017-09-25 ! -newerat 2017-09-26 -ls

List all *.c file accessed 30 days ago

Type the following command:
find /home/you -iname "*.c" -atime -30 -type f
OR
find /home/you -iname "*.c" -atime -30 -type f -ls

List all *.c file accessed more than 30 days ago

Type the following command:
find /home/you -iname "*.c" -atime +30 -type f
OR
find /home/you -iname "*.c" -atime +30 -type f -ls

List all *.c file accessed exactly 30 days ago

Type the following command:
find /home/you -iname "*.c" -atime 30 -type f
OR
find /home/you -iname "*.c" -atime 30 -ls

See also:

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Share this on (or read 7 comments/add one below):

7 comment

  1. There is an option to find, -newermt, which allows direct date comparisons. It is documented under the “-newerXY” option, where X and Y represent sub-options, which in this example are X=m for modified date, and Y=t for literal time. So for example, “find . -newermt “Sep 1 2006” -and \! -newermt “Sep 10 2006” will match all files modified between Sep 1 2006 and Sep 10 2006.

  2. It was very useful, thank you very much.
    Be careful when you remove files with the files that contain spaces and special characters.

  3. wasn’t working:
    find /home/you -iname "*.c" -atime -30 -type -f
    worked:
    find /home/you -iname "*.c" -atime -30 -type f

  4. Mistake :
    “Say hello to -newerXY option for find command
    The syntax is as follows:
    find /dir/ type -f -newerXY ‘yyyy-mm-dd’
    find /dir/ type -f -newerXY ‘yyyy-mm-dd’ -ls”
    it is : “-type f” not “type -f ” !! ;-)
    find /dir/ -type f -newerXY ‘yyyy-mm-dd’
    find /dir/ -type f -newerXY ‘yyyy-mm-dd’ -ls”

    Have a question? Post it on our forum!