In this tutorial, you’ll learn different ways to find recently modified files in Linux.
The GNU/Linux OS comes with many powerful utilities.
Among these utilities is a file searching utility called find.
When your problem statement includes “find” and “files” in the same sentence, chances are you can solve it with the GNU find utility.
Also referred to as the Linux find command, find gives you the power to find files and directories recursively based on the criteria that you specify.
Among the command’s many capabilities are finding files by modified time.
For this tutorial, we’ll start off with a general approach that show all modified files, followed by more precise approaches that are made possible by two find options: -mtime and -mmin.
find . -mtime <optional:modifier><time in days>
find . -mmin <optional:modifier><time in minutes>I’ll be explaining how they work through a number of examples below.
Special thanks to official find documentation and man find.
1. Find Recently Modified Files in Directories and Subdirectories
For this example, we’ll use find‘s -printf option to output the last-modified time and file paths. The output from this is then piped to a different command sort which will return to us with a list of files sorted by last-modified time from the oldest to the newest. The -type f argument asks find to look for files only, ignoring directories.
find . -type f -printf "%T+ %p\n" | sortOutput
2020-10-21+21:16:07.0000000000 ./dashicons.css
2021-04-23+06:58:05.0000000000 ./editor.css
2021-07-14+01:15:20.0000000000 ./block-library/editor-rtl.css
2021-07-19+08:56:57.0000000000 ./block-library/editor.min.css
2021-08-16+20:17:49.7400000000 ./block-library-printf is a powerful option that deserves a separate tutorial on its own, but for the purpose of this article, just remember this: -printf prints the file attributes specified by the user.
In the preceding example, %T+ tells find to print the last modified time, %p prints the file path. We then pipe the result to sort to arrange the result from the least to the most recently modified. %T supports a list of time units. For example %T@ outputs the number of seconds since the Epoch, %Ty outputs the year, etc.
See the command’s manual for a complete list of supported values (look for %A or %T). Use the man find command to bring up the manual or see this page.
Without user instructions, find will only return the relative paths. For comparison, here’s how it looks like by default:-
./block-library
./block-library/editor.min.css
./block-library/editor-rtl.css
./editor.css
./dashicons.cssVariation: Find Recently Modified Files in the Current Directory ONLY
Approach 1: ls
If you don’t need to find files recursively, you can choose to use the ls -lt command. ls lists directory content. The -l option provides details such as file permission, owner, group, and modified time. -t sorts the files by modified time from the newest to the oldest (so the most recently changed file will sit at the top).
Personally, when looking for recently change files, I prefer the newest files to display at the bottom just to save me some scrolling. To do that add -r to the command to reverse the display order: ls -ltr
The biggest advantage of this solution is that you can’t parse or pipe ls results.
Approach 2: find
Of course, you can also use find for this. You just have to limit max depth to 1 level.
find . -maxdepth 1 -type f -printf "%T+ %p\n" | sortIn the example above, max depth is set to 1. That option tells the program to only look at the current directory.
2. Find Files Modified in the Last Hour in Linux
Sometimes you’re only interested in files that were modified within the last hour.
To do that, use the -mmin option to specify time range in minutes.
find . -mmin -60The command above shows every file and sub-directory under the current directory (denoted by a single dot) that were modified in the last hour (60 minutes).
The minus sign (-) in front of 60 is important for the purpose of this example. It means newer than or less than. The -60 argument instructs find to look for files that have last-modified time that is less than 60 minutes ago.
A plus sign (+) means greater than, more than, or older than. For example, find . -mmin +60 returns files that were modified more than 60 minutes ago.
If it’s a number without any preceding symbols, it means that the matching files have to be modified precisely x minute ago. For example, find . -mmin 60 shows files that were modified precisely 60 minutes ago, not more, not less.
If you want to show the modified time, file path, and have the result sorted like Example #1, just add -printf "%T+ %p\n" | sort to the command. I.e.
find . -mmin -60 -printf "%T+ %p\n" | sort3. Find Recently Modified Files in the Past Hour
If you’re only interested in changed files and not directories, just add -type f to specify files-only.
find . -type f -mmin -604. Find Recently Modified Directories in the Past Hour
Conversely, use -type d to find directories that were modified in the past hour.
find . -type d -mmin -605. Find Files Modified in the Past 24 Hours
To do this you can reuse the command in the second example and change the number of minutes from 60 to 1440 minutes. 1440 minutes is the number of minutes in a day.
find . -mmin -1440Alternatively, you can use the -mtime option which is very similar to -mmin except that the time unit is days.
find . -mtime -1The sign in front of 1 follows the same convention as -mmin which I explained in example #2. In the example above, the command asks the utility to look for files that were modified within the last day or 24 hours.
6. List Files Last Modified in the Past 48 Hours
find . -mmin -28802880 is the number of minutes in 48 hours.
find . -mtime -248 hours is equivalent to 2 days.
7. List Files Last Modified in the Past X Hours (or Minutes)
In my opinion, the best way to find recently modified files within the last X hours or Y minutes is by using the -mmin option.
For last Y minutes it’s just
find . -mmin -<Y>For last X hours, just convert the number of hours to minutes:
find . -mmin -<X*60>8. Show Files Modified in the Past 3 Day
When your time frame is days instead of hours or minutes, -mtime may be a better choice than -mmin because you won’t have to do unit conversion.
The following example lists files and directories that were modified within the past 3 days.
find . -mtime -39. Show Files Modified in the Past 7 Days
find . -mtime -710. Show Files Modified in the Past 30 Days
find . -mtime -3011. Find Files Modified Between X to Y Minutes Ago
Sometimes we’re interested in knowing files that have been changed within a particular time period in the past.
For example, perhaps you detected some suspicious activities in the logs that happen roughly 40 minutes ago and you want to inspect the files that were changed during this period. One of the options is to use find to show files and directories that were changed between 30 minutes and 50 minutes ago:-
find . -mmin +30 -mmin -50The interpretation of this command follows the convention I explained earlier. -mmin +30 looks for files that are 30 minutes or older (>30). -mmin -50 looks for files that 50 minutes or newer (<50). When you combine the two, you get 30 < x < 50.
Here’s another example that finds files changed between 5 to 10 minutes ago:-
find . -mmin +5 -mmin -10
In a more general form:-
find . -mmin +<closer bound> -mmin -<further bound>
