Previously, we published a tutorial explaining how to list files by size in Linux. After reading the current tutorial, you will be able to list files by both last and first date modification, by a specific date, and last or first access on the current directory or the entire system.
The knowledge provided in this document is mandatory for all the Linux user levels.
All the steps shown in this article include screenshots to make it easy for all the Linux users to follow and apply them.
Topics explained in this document include:
- How to list files by last modification date
- Listing files by last access date
- How to list files by exact date
- Specific month modified files
- How to list files by time interval
- List newer or older than a specific date files
- Listing after certain minutes modified files
- What mtime, atime and ctime timestamps are?
Listing Files by Date Using the ls Command
The first command explained in this tutorial is the ls (list) command available in all the Linux distributions. In this section, you will learn the different tips to show files based on the different time/date related conditions.
1. Listing Files by Last Modification Date
In the first example, we list the files sorted by modification date within a directory. To achieve it, we execute the ls command followed by the -lt flag.
As you can see, the last modified files appear on top of the list.
You can get the inverse result, showing the last modified files within a directory at the bottom of the list. This can be done by adding an r to the previous flag, which means using the -ltr flag as shown in the following figure:
That’s how you can use the ls command to list the files by last modification time.
2. List Files by Last Access Date
To list the files by last access time, use the previous command adding a “u” in the flag as shown in the following example:
As you can see in the previous figure, the last accessed files show up on top of the list.
To print the last accessed files first, run the following command, adding an “r”.
Keep reading in the following illustrations to learn how to find the files by exact date.
3. List Files by Exact Date
If you want to search the files by the exact date, you can combine the ls with grep as shown in the following example. The following command shows all the modified files on the 2021-12-02 date.
4. List Specific Month Modified Files
The following example shows how to list the files by month. This shows all the files which were modified on a specific month, but not on a specific year. Therefore, if we search the files from May 31 using the following command, it shows the files modified on May 31 of all years.
Listing Files by Date Using the find Command
This section explains how to list the files by date with the find command, combined with the previous explained ls command.
The following section shows an additional listing time conditions.
1. How to List Files by Time Interval Using the find Command
The following example shows how to use the find command followed by the -mtime flag to list the files and directories under the /var/log/snort/ directory which were created or modified in the last 24 hours, where -1 indicates a day.
The following example does the same, but the -3 instead of -1 instructs find and ls to show the created or modified files in the last 3 days.
Contrary to the previous example, you also can use the mtime flag to specify the files before a specific date. For example, if we used the -3 flag to list the modified files in the last 3 days, we can use the +3 file to list the files which were modified before three days ago, older than 72 hours (without including files modified in the last 3 days).
Combining both options is possible like in the following example in which we list the files older than 5 days, but newer than 15 days.
The previously described methods are excellent to easily find the files you know when were created or modified.
2. List All Modified Files After or Before a Specific Date
You also can use the find command followed by the -newermt flag to find the files which were modified after or before a specific date.
The syntax is simple:
Therefore, if we want to list the files modified after 22/05/18, we run the command shown in the following figure:
Contrary to the previous example, if we want to list only the files which were modified before 2022/05/18, we run the command shown in the following screenshot. Note that we added a “!” symbol before the -newermt flag.
Keep reading to learn how to do the same with the minute units.
3. Listing After Certain Minutes Modified Files
When using the find command, you also can implement the -mmin flag to specify the minute units.
The following command instructs the find to show the files which were modified in the last 3 minutes within the current directory (Dot).
We optimized this tutorial for the users looking for a fast solution by showing practical examples first. You can read the explanation on how the previously described commands work in the following illustrations:
What Are mtime, atime and ctime Timestamps
Every Linux file (including directories) has 3 timestamps in its metadata which contain information on file access, file modification, or metadata modification.
The mtime, atime and ctime timestamps are known as MAC Timestamps because of their initials.
- The mtime Timestamp: This timestamp contains information on file creation or modification date. This is the timestamp checked by the previously explained commands when we want to manage or list the files by their creation or modification date.
- The atime Timestamp: This timestamp contains information about the file’s last access. This is the timestamp checked by the previously explained commands when we want to list the last accessed files.
- The ctime Timestamp: This timestamp does not contain information on the file itself, but on its metadata. This timestamp does not inform us about modifications on the file content, but modifications on the metadata like file permissions. If we are looking for files whose permissions were recently edited, we can use the ctime to find these files.
By learning what timestamps are, you can understand how the commands we executed in the previous sections work.
Conclusion
As any user may suppose, knowing how to find and list the files by date or time is a must to know for every Linux user. This can help us for any type of task, from daily tasks to related administration complex tasks. As you can see, all the described steps are pretty easy to learn and implement. In some cases, you can get the same result using the different commands. Here, we only described a way for each listing type to avoid redundancy and prioritize the user understanding.
Any Linux user can incorporate those commands and improve his experience before the Linux terminals. It is highly recommended to practice all the examples shown, at least to remember their existence, by reading the man page for specifications. All instructions in this document are useful for all the Linux distributions.
Thank you for reading this tutorial explaining how to list the files by date in Linux. Keep following us for more professional Linux articles.
