Find Files That Have Been Changed Recently in Linux

1. Introduction

There are various occasions when we want to search for files that have been changed recently.

For example, as a system admin, we’re responsible to maintain and configure computer systems. Sometimes, because we’re dealing with a lot of configuration files, we probably want to know what are the files recently modified.

In this tutorial, we’re going to find the files that have been changed recently in Linux using bash commands.

2. The find Command

First, we’ll explore the find utility which is the most common way to achieve the intended purpose. This command is used to find files and directories recursively and to execute further operations on them. 

2.1. -mtime and -mmin

-mtime is handy, for example, if we want to find all the files from the current directory that have changed in the last 24 hours:

find . -mtime -1

Note that the . is used to refer to the current directory. -mtime n is an expression that finds the files and directories that have been modified exactly n days ago.

In addition, the expression can be used in two other ways:

• -mtime +n = finds the files and directories modified more than n days ago
• -mtime -n = finds the files and directories modified less than n days ago

In the same way, we can use the -mmin n expression to rely on minutes instead of days:

find /home/sports -mmin +120

So, this command recursively finds all the files and directories from the /home/sports directory modified at least 120 minutes ago.

Next, if we want to limit the searching only to files, excluding directories, we need to add the -type f expression:

find /home/sports -type f -mmin +120

Furthermore, we can even compose expressions. So, let’s find the files that have been changed less than 120 minutes ago and more than 60 minutes ago:

find . -type f -mmin -120 -mmin +60

2.2. -newermt

There are times when we want to find the files that were modified based on a particular date. In order to fulfill this requirement, we have to explore another parameter, which has the following syntax:

-newermt 'yyyy-mm-dd'

By using this expression, we can get the files that have been changed earlier than the specified date.

So, let’s build a command to better understand the new parameter:

find . -type f -newermt 2019-07-24

Moreover, we could get the files modified on a specific date by using a composed expression.

So, we’re going to get the files modified on ‘2019-07-24’:

find . -type f -newermt 2019-07-24 ! -newermt 2019-07-25

Finally, there’s another version of the -newermt parameter similar to -mmin and -mtime.

The first command finds the files modified in the last 24 hours. The rest of them are similar:

find . -type f -newermt "-24 hours" 
find . -type f -newermt "-10 minutes" 
find . -type f -newermt "1 day ago" 
find . -type f -newermt "yesterday"

3. The ls command

We know that the ls command lists information about the files in a specific directory. One of its usages is to show the long format of the files and to sort the output by modification time:

ls -lt

Which would result in something like:

-rw-r--r-- 1 root root 4233 Jul 27 18:44 b.txt 
-rw-rw-r-- 1 root root 2946 Jul 27 18:12 linux-commands.txt 
-rw-r--r-- 1 root root 5233 Jul 20 17:02 a.txt

We may not be able to list the files recently modified exactly as the find command does. But, we can filter the above output based on a specific date or time by applying the grep command on the result of the ls command:

ls -lt | grep 'Jul 27'

-rw-r--r-- 1 root root 4233 Jul 27 18:44 b.txt 
-rw-rw-r-- 1 root root 2946 Jul 27 18:12 linux-commands.txt

ls -lt | grep '17:'

-rw-r--r-- 1 root root 5233 Jul 20 17:02 a.txt

Note that the find command is recursive by default. In order to enable the recursive capability on the ls command, we also need to add the R(uppercase) parameter:

ls -ltR

4. Conclusion

In this quick tutorial, we’ve described a few ways that help us find the files that have been changed recently on a Linux operating system.

First, we’ve explored the find command and created several examples with different parameters like -mtime, -mmin and -newermt.

Then, we’ve shown how we can achieve similar results using a combination of two better known Linux utilities like the ls and grep commands.