How to find recently modified files in Linux

If you are working on thousands of files a day and want to find a list of files that have been modified recently in a directory for certain purposes, this can be done easily using the find command.

The find command is used to search or locate files based on various criteria such as timestamp, file type and file permissions in Linux.

Please refer to our previous article on how to find a directory size in Linux.

In this article, we have included 13 examples for locating files based on timestamp and I hope this article will meet your needs.

In Linux, a file contains three timestamps, which are updated when a file is accessed or modified or replaced.

Types of file timestamps:

  • atime: access time or Last access time
  • mtime: modify time or Last modification time
  • ctime: change time or Last change time

Read the below explanation for better understanding about timestamp.

  • atime/amin: The last time the file was accessed by some command or application.
  • mtime/mmin: The last time the file’s contents was modified.
  • ctime/cmin: The last time the file’s attribute was modified.

How to check all timestamps of a file?

It can be easily seen using ‘stat’ command, which displays all three timestamps of a file.

The common syntax is as follows:

stat [File_Name]
# stat /home/daygeek/shell-script/remote-backup.sh

  File: /home/daygeek/shell-script/remote-backup.sh
  Size: 436       	Blocks: 8          IO Block: 4096   regular file
Device: 10301h/66305d	Inode: 2490772     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/ daygeek)   Gid: ( 1000/ daygeek)
Access: 2019-09-08 01:00:20.963127924 +0530
Modify: 2019-09-08 01:04:56.274279514 +0530
Change: 2019-09-08 01:04:56.274279514 +0530
 Birth: 2019-09-08 01:00:20.963127924 +0530

We can use numerical arguments with ‘mtime’. Use “-mtime n” command to return a list of files that were last modified “n” hours ago.

  • +n: for greater than n
  • -n: for less than n
  • n: for exactly n

See the format below for a better understanding.

  • -mtime +10: This will find all files that were modified 10 days ago.
  • -mtime -10: It will find all files that were modified in the last 10 days.
  • -mtime 10: Use this format to find all files that were modified EXACTLY 10 days ago.

1) Sorting files & folders based on conversion time

This can be done by using the ls command with some options as shown below, which sorts the files and folders in reverse order based on the conversion time.

# ls -ltrh /home/daygeek/shell-script

total 312K
-rw-r--r-- 1 daygeek daygeek  616 Jun  2 13:25 cpu-alert2.sh
-rw-r--r-- 1 daygeek daygeek  830 Jun 14 11:54 process.sh
-rw-r--r-- 1 daygeek daygeek  776 Jun 14 12:00 memory-monitor.sh
-rw-r--r-- 1 daygeek daygeek  157 Jul 29 18:29 service1.sh
-rw-r--r-- 1 daygeek daygeek  361 Jul 29 19:45 service3a.sh
-rw-r--r-- 1 daygeek daygeek  296 Aug  4 01:27 servicem.sh
drw-r--r-- 3 daygeek daygeek 4.0K Aug 19 12:33 backup
-rwxr-xr-x 1 daygeek daygeek   73 Aug 23 12:51 guna_server.sh
-rw-r--r-- 1 daygeek daygeek  436 Sep  8 01:04 remote-backup.sh
-rw-r--r-- 1 daygeek daygeek  367 Sep  8 01:19 remote-backup-2.sh
-rw-r--r-- 1 daygeek daygeek  418 Sep  8 03:54 remote-backup-1.sh
-rw-r--r-- 1 daygeek daygeek  459 Sep  8 04:21 list-remote-backup.sh
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:53 test
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:54 test1
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:54 test3

2) Sorting only folders based on conversion time

Use the following format to sort only folders in reverse order based on conversion time.

# ls -ltrh /home/daygeek/shell-script | grep ^d

drw-r--r-- 3 daygeek daygeek 4.0K Aug 19 12:33 backup
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:53 test
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:54 test1
drwxr-xr-x 2 daygeek daygeek 4.0K Sep 20 12:54 test3

3) How to find only files that were modified 120 days ago

The below find command will show a list of files that were changed 120 days ago.

# find /home/daygeek/shell-script -type f -mtime +120 -ls

  2491042      4 -rw-r--r--   1  daygeek  daygeek       410 Apr 27 23:58 /home/daygeek/shell-script/disk-space-alert.sh
  1705245      4 -rwxr-xr-x   1  daygeek  daygeek        41 Jan 15  2019 /home/daygeek/shell-script/ovh.sh
  1704244      4 -rw-r--r--   1  daygeek  daygeek        99 Jan 19  2019 /home/daygeek/shell-script/file-copy.sh
  1744131      4 -rwxr-xr-x   1  daygeek  daygeek      1361 Feb  9  2019 /home/daygeek/shell-script/cpu-mem-check.sh
  1719630      4 -rwxr-xr-x   1  daygeek  daygeek        82 Mar  1  2019 /home/daygeek/shell-script/pass-gen.sh
  1719891      4 -rwxr-xr-x   1  daygeek  daygeek       274 Mar 16  2019 /home/daygeek/shell-script/pass-multi-user.sh
  2490973      4 -rwxr-xr-x   1  daygeek  daygeek       237 Apr  6 10:40 /home/daygeek/shell-script/mysql_backup_1.sh
  2490935      0 -rw-r--r--   1  daygeek  daygeek         0 Apr 29 10:25 /home/daygeek/shell-script/test.txt
  1736513      4 -rw-r--r--   1  daygeek  daygeek       227 Mar 17  2019 /home/daygeek/shell-script/server-list.txt
  2490942      8 -rw-r--r--   1  daygeek  daygeek      4780 Apr 11 14:57 /home/daygeek/shell-script/2g.out
  1738172      4 -rwxr-xr-x   1  daygeek  daygeek       214 Mar 10  2019 /home/daygeek/shell-script/user-add.sh
  1719571      4 -rwxr-xr-x   1  daygeek  daygeek       151 Mar 16  2019 /home/daygeek/shell-script/pass-up.sh
  2491095    140 -rwxr-xr-x   1  daygeek  daygeek    139406 May 12 20:26 /home/daygeek/shell-script/xsos
  1720392      4 -rwxr-xr-x   1  daygeek  daygeek        76 Mar 17  2019 /home/daygeek/shell-script/port_scan.sh
  1730638      4 -rwxr-xr-x   1  daygeek  daygeek        98 Jan 11  2019 /home/daygeek/shell-script/passwd-up1.sh
  2490982      4 -rwxr-xr-x   1  daygeek  daygeek       241 Apr  6 10:49 /home/daygeek/shell-script/mysql_backup_2.sh
  2490955      4 -rwxr-xr-x   1  daygeek  daygeek       761 Apr  6 21:36 /home/daygeek/shell-script/mysql_backup.sh
  1717834      4 -rwxr-xr-x   1  daygeek  daygeek       159 Jan 11  2019 /home/daygeek/shell-script/passwd-up.sh
  2491025      4 -rw-r--r--   1  daygeek  daygeek        78 Apr 26 11:39 /home/daygeek/shell-script/bulk-package-install.sh

4) How to find only files that were modified in last 15 days

The below find command will show a list of files that have changed in the last 15 days:

# find /home/daygeek/shell-script -type f -mtime -15 -ls

  2490782      4 -rw-r--r--   1  daygeek  daygeek       418 Sep  8 03:54 /home/daygeek/shell-script/remote-backup-1.sh
  2494508      4 -rw-r--r--   1  daygeek  daygeek       436 Sep 20 12:54 /home/daygeek/shell-script/test3/remote-backup.sh
  2490783      4 -rw-r--r--   1  daygeek  daygeek       538 Sep 20 12:53 /home/daygeek/shell-script/test/cpu-alert.sh
  2490772      4 -rw-r--r--   1  daygeek  daygeek       436 Sep  8 01:04 /home/daygeek/shell-script/remote-backup.sh
  2494505      4 -rw-r--r--   1  daygeek  daygeek       776 Sep 20 12:54 /home/daygeek/shell-script/test1/memory-monitor.sh
  2490786      4 -rw-r--r--   1  daygeek  daygeek       367 Sep  8 01:19 /home/daygeek/shell-script/remote-backup-2.sh
  2490789      4 -rw-r--r--   1  daygeek  daygeek       459 Sep  8 04:21 /home/daygeek/shell-script/list-remote-backup.sh

5) How to find only files that were modified exactly 10 days ago

The below find command will show you a list of files that were changed exactly 10 days ago:

# find /home/daygeek/shell-script -type f -mtime 10 -ls

  2490782      4 -rw-r--r--   1  daygeek  daygeek       418 Sep  8 03:54 /home/daygeek/shell-script/remote-backup-1.sh
  2490772      4 -rw-r--r--   1  daygeek  daygeek       436 Sep  8 01:04 /home/daygeek/shell-script/remote-backup.sh
  2490786      4 -rw-r--r--   1  daygeek  daygeek       367 Sep  8 01:19 /home/daygeek/shell-script/remote-backup-2.sh
  2490789      4 -rw-r--r--   1  daygeek  daygeek       459 Sep  8 04:21 /home/daygeek/shell-script/list-remote-backup.sh

6) How to find only files that were modified within last 30 Mins

The below find command will show a list of files that have changed within the last 30 mins.

# find /home/daygeek/ -type d -mmin -30 -ls

  6553934      4 drwx------   2  daygeek  daygeek      4096 Sep 20 14:08 /home/daygeek/.cache/google-chrome/Default/Cache/index-dir
  1974320      4 drwxr-xr-x   3  daygeek  daygeek      4096 Sep 20 14:06 /home/daygeek/.config/Notepadqq/backupCache
  1974321      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 14:06 /home/daygeek/.config/Notepadqq/backupCache/window_94904345125616
  6553884      4 drwx------  19  daygeek  daygeek      4096 Sep 20 14:03 /home/daygeek/.config/google-chrome
  6553899      4 drwx------  26  daygeek  daygeek      4096 Sep 20 14:07 /home/daygeek/.config/google-chrome/Default
  6553923      4 drwx------   2  daygeek  daygeek      4096 Sep 20 13:50 /home/daygeek/.config/google-chrome/Default/Sync\ Data/LevelDB
  6823938      4 drwx------   2  daygeek  daygeek      4096 Sep 20 14:03 /home/daygeek/.config/google-chrome/Default/databases/https_translate.google.co.in_0
  6553915      4 drwx------   2  daygeek  daygeek      4096 Sep 20 13:54 /home/daygeek/.config/google-chrome/Safe\ Browsing
  1704068      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 14:05 /home/daygeek/.local/share/tracker/data
  1704089      4 drwx------   2  daygeek  daygeek      4096 Sep 20 14:04 /home/daygeek/.local/share/gvfs-metadata
  1703995      4 drwx------   3  daygeek  daygeek      4096 Sep 20 14:05 /home/daygeek/.local/share/gnome-shell

7) How to find only the folder’s modified in last 5 Days

This command displays only folders modified within the last 5 days.

# find /home/daygeek/shell-script -type d -mtime -5 -ls

  2494645      4 drwxr-xr-x   6  daygeek  daygeek      4096 Sep 20 12:55 /home/daygeek/shell-script
  2498566      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test3
  2498564      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:53 /home/daygeek/shell-script/test
  2498565      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test1

8) How to find both Files and Folders that were modified in last 15 Days

This command displays a list of files and folders modified within last 15 days:

# find /home/daygeek/shell-script -mtime -15 -ls

  2494645      4 drwxr-xr-x   6  daygeek  daygeek      4096 Sep 20 12:55 /home/daygeek/shell-script
  2490782      4 -rw-r--r--   1  daygeek  daygeek       418 Sep  8 03:54 /home/daygeek/shell-script/remote-backup-1.sh
  2498566      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test3
  2494508      4 -rw-r--r--   1  daygeek  daygeek       436 Sep 20 12:54 /home/daygeek/shell-script/test3/remote-backup.sh
  2498564      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:53 /home/daygeek/shell-script/test
  2490783      4 -rw-r--r--   1  daygeek  daygeek       538 Sep 20 12:53 /home/daygeek/shell-script/test/cpu-alert.sh
  2490772      4 -rw-r--r--   1  daygeek  daygeek       436 Sep  8 01:04 /home/daygeek/shell-script/remote-backup.sh
  2498565      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test1
  2494505      4 -rw-r--r--   1  daygeek  daygeek       776 Sep 20 12:54 /home/daygeek/shell-script/test1/memory-monitor.sh
  2490786      4 -rw-r--r--   1  daygeek  daygeek       367 Sep  8 01:19 /home/daygeek/shell-script/remote-backup-2.sh
  2490789      4 -rw-r--r--   1  daygeek  daygeek       459 Sep  8 04:21 /home/daygeek/shell-script/list-remote-backup.sh

9) How to find modified files and folders starting from a given Date to the latest Date

This command allows you to find a list of files and folders that have been modified starting from a given date to the latest date:

# find /home/daygeek/shell-script -newermt "2019-09-08" -ls

  2494645      4 drwxr-xr-x   6  daygeek  daygeek      4096 Sep 20 12:55 /home/daygeek/shell-script
  2490782      4 -rw-r--r--   1  daygeek  daygeek       418 Sep  8 03:54 /home/daygeek/shell-script/remote-backup-1.sh
  2498566      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test3
  2494508      4 -rw-r--r--   1  daygeek  daygeek       436 Sep 20 12:54 /home/daygeek/shell-script/test3/remote-backup.sh
  2498564      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:53 /home/daygeek/shell-script/test
  2490783      4 -rw-r--r--   1  daygeek  daygeek       538 Sep 20 12:53 /home/daygeek/shell-script/test/cpu-alert.sh
  2490772      4 -rw-r--r--   1  daygeek  daygeek       436 Sep  8 01:04 /home/daygeek/shell-script/remote-backup.sh
  2498565      4 drwxr-xr-x   2  daygeek  daygeek      4096 Sep 20 12:54 /home/daygeek/shell-script/test1
  2494505      4 -rw-r--r--   1  daygeek  daygeek       776 Sep 20 12:54 /home/daygeek/shell-script/test1/memory-monitor.sh
  2490786      4 -rw-r--r--   1  daygeek  daygeek       367 Sep  8 01:19 /home/daygeek/shell-script/remote-backup-2.sh
  2490789      4 -rw-r--r--   1  daygeek  daygeek       459 Sep  8 04:21 /home/daygeek/shell-script/list-remote-backup.sh

10) How to find all files and folders modified in the Last 24 Hours

Alternatively, you can use an easy-to-understand format like the one below to find files and folders that have changed over the past 24 hours.

# find /home/daygeek -newermt "1 day ago" -ls
or
# find /home/daygeek -newermt "-24 hours" -ls
or
# find /home/daygeek -newermt "yesterday" -ls

  1704781     36 -rw-------   1  daygeek  daygeek     35943 Sep 20 12:13 /home/daygeek/.local/share/keyrings/login.keyring
  1705911      8 -rw-r--r--   1  daygeek  daygeek      4548 Sep 20 12:15 /home/daygeek/Remove-Symbolic-Links-in-Linux.txt
  1703977     56 drwxr-xr-x  14  daygeek  daygeek     53248 Sep 20 08:04 /home/daygeek/Downloads
  1707507     36 -rw-r--r--   1  daygeek  daygeek     36092 Sep 20 08:04 /home/daygeek/Downloads/picture-networking-9.png
  2490860     20 drwxr-xr-x   4  daygeek  daygeek     20480 Sep 20 08:18 /home/daygeek/Desktop/Daily_Activity/2g-images/Designed_Image
  2490796     72 -rw-r--r--   1  daygeek  daygeek     71000 Sep 20 08:18 /home/daygeek/Desktop/Daily_Activity/2g-images/Designed_Image/how-to-remove-delete-symbolic-links-in-linux-1.png
  1966609    188 -rw-r--r--   1  daygeek  daygeek    192110 Sep 20 12:39 /home/daygeek/Desktop/Daily_Activity/magi.txt
  1709893     36 -rw-r--r--   1  daygeek  daygeek     34631 Sep 20 07:36 /home/daygeek/old-Mysqladmin-command.txt
  1710619     40 drwxr-xr-x   2  daygeek  daygeek     36864 Sep 20 12:35 /home/daygeek/Pictures/BingWallpaper
  1710658    340 -rw-r--r--   1  daygeek  daygeek    348014 Sep 20 12:35 /home/daygeek/Pictures/BingWallpaper/20190920-th?id=OHR.ThePando_EN-US1263045290_1920x1080.jpg

11) How to find a list of “sh” extension files accessed in the Last 30 Days

This command helps you to find a list of files with “sh” extension accessed in the last 30 days.

# find /home/daygeek/shell-script  -type f -iname "*.sh" -atime -30 -ls

  2490782      4 -rw-r--r--   1  daygeek  daygeek       418 Sep  8 03:54 /home/daygeek/shell-script/remote-backup-1.sh
  2494508      4 -rw-r--r--   1  daygeek  daygeek       436 Sep 20 12:54 /home/daygeek/shell-script/test3/remote-backup.sh
  2490783      4 -rw-r--r--   1  daygeek  daygeek       538 Sep 20 12:53 /home/daygeek/shell-script/test/cpu-alert.sh
  2490772      4 -rw-r--r--   1  daygeek  daygeek       436 Sep  8 01:04 /home/daygeek/shell-script/remote-backup.sh
  2494505      4 -rw-r--r--   1  daygeek  daygeek       776 Sep 20 12:54 /home/daygeek/shell-script/test1/memory-monitor.sh
  2490786      4 -rw-r--r--   1  daygeek  daygeek       367 Sep  8 01:19 /home/daygeek/shell-script/remote-backup-2.sh
  2490789      4 -rw-r--r--   1  daygeek  daygeek       459 Sep  8 04:21 /home/daygeek/shell-script/list-remote-backup.sh

12) How to find files that have been modified over a period of time

The below command shows a list of files that have changed in the last 20 minutes.

# find /home/daygeek -cmin -20 -ls

  6595804  11440 -rw-r--r--   1  daygeek  daygeek  11713819 Sep 20 13:24 /home/daygeek/.config/google-chrome/Safe\ Browsing/UrlSoceng.store
  6586612     12 -rw-r--r--   1  daygeek  daygeek     11171 Sep 20 13:24 /home/daygeek/.config/google-chrome/Safe\ Browsing/UrlSuspiciousSite.store
  6595504    216 -rw-r--r--   1  daygeek  daygeek    219195 Sep 20 13:24 /home/daygeek/.config/google-chrome/Safe\ Browsing/UrlUws.store
  6553893     28 -rw-------   1  daygeek  daygeek    270336 Sep 20 13:32 /home/daygeek/.config/google-chrome/ShaderCache/GPUCache/data_1
  6595827     88 -rw-------   1  daygeek  daygeek     87328 Sep 20 13:20 /home/daygeek/.config/google-chrome/Local\ State
  2490785    104 -rw-r--r--   1  daygeek  daygeek    105595 Sep 20 13:30 /home/daygeek/.local/share/fish/fish_history
  1703995      4 drwx------   3  daygeek  daygeek      4096 Sep 20 13:33 /home/daygeek/.local/share/gnome-shell
  1704389      4 -rw-r--r--   1  daygeek  daygeek      1258 Sep 20 13:33 /home/daygeek/.local/share/gnome-shell/application_state
  1707425     16 -rw-------   1  daygeek  daygeek     14108 Sep 18 12:52 /home/daygeek/.bash_history

13) How to find a list of files created Today

This command enables you to find a list of files created today:

# find /home/daygeek/shell-script -type f -ctime -1 -ls

2494508      4 -rw-r--r--   1  daygeek  daygeek       436 Sep 20 12:54 /home/daygeek/shell-script/test3/remote-backup.sh
2490783      4 -rw-r--r--   1  daygeek  daygeek       538 Sep 20 12:53 /home/daygeek/shell-script/test/cpu-alert.sh
2494505      4 -rw-r--r--   1  daygeek  daygeek       776 Sep 20 12:54 /home/daygeek/shell-script/test1/memory-monitor.sh

Closing Notes

This article explained how to find recently modified files & folders in Linux.

If you have any questions or feedback, feel free to comment below.

About Magesh Maruthamuthu

Love to play with all Linux distribution

View all posts by Magesh Maruthamuthu

Leave a Reply

Your email address will not be published. Required fields are marked *