Command to find files for a specific time range

I have a few Linux Red Hat Linux machines and I must find some files on them. The problem is that they have a lot of files and folders since 2004 year. And I don't know where exactly to look for these files.

Is there some terminal command with which I can select a specific time range. I want to see every file which is changed from last month (May) to now.

Jason Paddle

Posted 2012-06-28T06:16:29.367

Reputation: 593

Answers

Yes, the find command can do this. It will take some experimentation and reading and re-reading the man page to get it to do what you want, but is amazing command. Below are 2 examples:

find . -type f -ctime -2 -print0 | xargs -0 tar -rvf ~/dev_customer_attributes.tar
find . -mmin -400 > /tmp/files.txt

The 1st find uses -type f to list only files. -type d for directories. -ctime -2 is for files with a created time less than 2 days old and then adds them to the tar archive. I can't remember from when I used this command or why.

The 2nd command checks for files and directories modified within the last 400 days and outputs that list to files.txt Here's a great info page I just found, too.

Example, In my ~ on my personal laptop are files as old as 2010. And lots that are newer, too. By running find . -ctime -1000 -ctime +600, I get listing like this:

./Pictures/Photos
./Pictures/Photos/2005
./Pictures/Photos/2005/08
./Pictures/Photos/2005/08/29
./Pictures/Photos/2005/08/29/DSCN1023.JPG
./Pictures/Photos/2009
./Pictures/Photos/2009/02
./Pictures/Photos/2009/02/23
./Pictures/Photos/2009/02/23/img_0001.jpg
./Pictures/Photos/2010
./Pictures/Photos/2010/01
./Pictures/Photos/2010/01/01
./Pictures/Photos/2010/01/01/DSCN2170.JPG
./Pictures/Photos/2010/01/01/DSCN2171.JPG
./Pictures/Photos/2010/06
./Pictures/Photos/2010/06/04
./Pictures/Photos/2010/06/04/img_0111.jpg
./Pictures/Photos/2010/06/04/img_0112.jpg
./Pictures/Webcam/2010-10-03-045227.jpg
./.mission-control
./.mission-control/accounts
./.mission-control/accounts/accounts.cfg

In this case, the Pictures folder had legacy items copied over from before 2010, but which happened with the 400 day period 600 days ago.

Chris K

Posted 2012-06-28T06:16:29.367

Reputation: 923

But i don't know in witch folder and what file exactly i looking for. I mean that's why i need to see witch file were modified last 30 days in whole system. – Jason Paddle – 2012-06-28T06:57:20.907

Yes, so move to /, omit the -type look for -ctime of - 8 years of days and another -ctime of something like + 4 years in days. This will list all folders and files which meet the time criteria. Editing answer to show example... – Chris K – 2012-06-28T06:59:46.507

this work I just need to write correct time range – Jason Paddle – 2012-06-28T07:23:12.390

8 years is 2920 days, just figure out the "new" cutoff date. I just wing it with size of the output. I also use wc to see how many lines of text a command returns to see the size of it. You could do -3000 +2000 and move the +2000 up or down from there. – Chris K – 2012-06-28T07:27:50.123

1Might want to use -print0 with find and xargs -0 in order to be safe. – slhck – 2012-06-28T09:15:00.393

It should be mtime instead of ctime if you want find files which CONTENT was changed. At this point ctime is changed, too - but not only than, so this could result in a missleading list. See this wonderful explanation about ctime, mtime and atime: http://www.linux-faqs.info/general/difference-between-mtime-ctime-and-atime

– Jimmy Koerting – 2013-12-30T12:34:49.240

@JimmyKoerting in reading the comments to another answer, mtime didn't work for the OP but ctime did. – Chris K – 2013-12-30T12:47:50.477

$ man find

find . -name '*.doc' -type f -mtime -28

Lists all .doc-Files below (and in) the current directory that have an 'mtime' (modify date) newer than 28 days.

ppuschmann

Posted 2012-06-28T06:16:29.367

Reputation: 291

I believe -28 means newer than 28 days. – Chris K – 2012-06-28T07:35:20.690

1You're correct. I fixed this. Just switched the words. – ppuschmann – 2012-06-28T07:38:14.527

find is what you are looking for

find . -newermt "2012-05-01 00:00:00"

This will give you a list of files that match.
You can add the -ls flag for more information. Like this

find . -newermt "2012-05-01 00:00:00" -ls

Nifle

Posted 2012-06-28T06:16:29.367

Reputation: 31 337

1find: invalid predicate `-newermt' this i get – Jason Paddle – 2012-06-28T06:47:29.547

well I'm connected right now with putty to server – Jason Paddle – 2012-06-28T06:58:41.843

@JasonPaddle - If you can't get the -newermtflag to work I suggest you use -mtime -28 instead (as suggested elsewhere). It will give the same result but require you to do the maths (so if you run it tomorrow it will be -mtime -29 and so on). – Nifle – 2012-06-28T07:01:40.263

with -mtime i get only one result. One file from today witch is modified 1 hour ago: find . -mtime -28 -ls – Jason Paddle – 2012-06-28T07:13:25.740

@JasonPaddle - Are you invoking the command in the correct location? Can you manually find a file that the command missed? – Nifle – 2012-06-28T07:21:29.423

with -ctime i got the results – Jason Paddle – 2012-06-28T07:24:24.510

@JasonPaddle - Another thing, find does not follow symbolic links by default. Try adding the -follow flag. – Nifle – 2012-06-28T07:24:40.497

1@JasonPaddle - Glad you sorted it out. – Nifle – 2012-06-28T07:26:00.927

I think you will need the -mtime parameter of the find command. See if this is any help: http://www.cyberciti.biz/faq/howto-finding-files-by-date/

Petkaux

Posted 2012-06-28T06:16:29.367

Reputation: 211