In this short tutorial, I’ll show you how to find files that were modified between X and Y days ago on a GNU/Linux OS.
I have only tested these commands on Ubuntu, but they should also work for all GNU/Linux distros, e.g. Debian, Centos, etc.
If you’re in a hurry, here are some commands for quick reference.
Commands to Find Modified Files Between X and Y Days Ago
1. Find files and directories modified between 7 and 14 days ago:
find . -mtime +7 -mtime -142. Find files (exclude directories) modified between 30 and 60 days ago:
find . -type f -mtime +30 -mtime -603. Find files modified between today and 7 days ago (i.e. last 7 days):
find . -type f -mtime -7Below are the explanation for these commands.
Use find -mtime to Locate Files by Modified Time
GNU find supports a few options that let you find files by last-modified time.
These options are newer, newermt, mmin, and mtime.
newer is used when you are comparing against a particular file’s timestamp.
newermt is used when you know a specific date to use for comparison.
mmin lets you specify modified time, relative to now, in minutes. This is useful when you need to look for files were change x minutes ago.
And finally, mtime which lets you specify last-modified time in days, relative to today.
Since the problem we’re dealing with (file changed X days ago) is both relative and on the scale of days, mtime is the way to go.
find . -type f -mtime +7In the command above, the dot (.) instructs find to start looking within the current directory. -type f says to look for files only. -mtime +7 asks find to return files that are older than 7 days.
The prefix in front of 7 is important, as it can change the way the utility interprets the argument completely.
The plus sign (+) means older than or greater than.
If you change the sign to a minus sign (-), that means newer than or lesser than. For example, -mtime -14 means less than 14 days old.
A bare number without any prefix instructs find to look for files that were changed on that specific day. For instance, -mtime 30 asks find to show files that were changed precisely thirty days ago.
Both -mtime and -mmin can be used multiple times. This is used to specify ranges of time.
find . -type f -mtime +30 -mtime -60In the preceding example, -mtime +30 says that the files have to be older than 30 days, -mtime -60 says to look for files that are less than 60 days old. When used in combination, find will return files that were changed between 30 and 60 days ago.
Generalized form
find . -type f -mtime +<nearer bound> -mtime -<further bound>
