This Linux tutorial explains how to find files by mtime (Modification time) using different techniques any user must know.
After reading this tutorial you will be able to list and find files depending on their last modification time (mtime).
After practical examples, you will find a comprehensive explanation on mtime, ctime, and atime. This content is optimized for both Linux experienced and new users.
All instructions described in this article include screenshots to make it easy for all users to understand and apply them.
How to find mtime using the ls command
This section describes different methods to find files mtime using the ls Linux command.
The first example shows how to find a specific file mtime (Modification time) using the ls (List) command followed by the -l flag and the filename.
The syntax is:
In the example below I will check for the wpa.hash file mtime using the command explained above.
As you can see, the last modification time of the wpa.hash file is 20 July 2021.
The next example shows how to list all files mtime within the current directory.
The syntax is simple, just don’t specify a file as shown below.
The first line shows the file was modified on August 26, 2021. The second file was modified on December 13 at 13:20. In this case, additional to the date, the time is revealed because the file was modified in the current year.
You can specify another directory other than the current one, as shown in the following example, in which files under the /usr directory are listed with mtime.
Finding mtime with the find command
The second section of this tutorial explains how to find mtime using the find Linux command, in some cases combined with the previously used ls command.
The find command can be used with the -mtime flag to find both modified files after a specific day or before a specific day.
The command below shows how to find modified files from 20 days ago up to this day. The syntax is the following:
Where </Directory> is the directory containing files or directories whose mtime you want to list. <Days> specifies the number of days from which you want to learn their mtime. In other words, the command below will show modified files in the last 20 days.
Contrary to the previous example, the following command will list the files that was modified from 20 days.
The only difference in the syntax is the – replacement with + as shown below.
Therefore, if I want to list modified files before the last 20 days, I run the following command:
You can combine both + and – to get the files by mtime before and after specific days.
For example, if you want to list files older than 20 days, but newer than 50 days, you can run the following command. This will show you modified files between 20 and 50 days ago, not less than 20, no more than 50.
Understanding mtime, atime and ctime
All Linux files (And directories) have three-time indicators (timestamps) in their metadata that contains information about file access, modification, and metadata changes.
The mtime, atime, and ctime timestamps (known as MAC timestamps) have the following characteristics:
- The mtime timestamp: prints information on file creation or modification time. This is the timestamp we focused on in this article, printing the last modification or the creation date.
- The atime timestamp: Prints data about files last access. This is the timestamp we need to check when we want to learn last accessed files or last access to specific files.
- The ctime timestamp: The ctime timestamp doesn’t contain information about the file itself or its content, but about its metadata. It means this command is not used to learn last file access or last modification but metadata modifications such as permissions. If we are looking for files whose permissions were recently updated, we can run this command to search files by ctime.
Conclusion:
As you can see above, learning how to list, find files, and directories by last modification time is very important for all Linux users. This can be useful for daily and complex tasks. All previously described instructions are easy to study and apply. Thanks to Linux flexibility you can get the same result using different techniques.
Every Linux user can learn how to apply those commands and improve his expertise level when interacting with Linux consoles.
