How to use find to Find Files by Access Time

This blog post will teach you how to use find command to find files by access time in Linux. You will learn how to use the -atime option to specify the access time criteria, and how to use various other options to filter the results.

find can match by inode timestamps
- -atime when file was last read
- -mtime when file data last changed
- -ctime when file data or metadata last changed
Value given is in days
- find /tmp -ctime +10
  - files changed more than 10 days ago
Can use a vlue of minutes
- -amin
- -mmin
- -cmin
- find /etc -amin -60

Examples of find timestamp-matching criteria are given in the previous Post Find and Numeric Criteria. While the values passed to -atime, -ctime and -mtime are measured in days, there are also corresponding criteria that perform searches in minutes: -amin, -cmin and -mmin. You can evern match access times relative to the timestamps of other files using -anewer, -cnewer and -newer, which tests mtime. For example:

[user@user-pc ~]$ find -newer recent_file.txt

Would list all files with mtimes more recent than that of recent_file.txt. Note that there is no -older argument. To match files older than recent_file.txt you would simply negate the -newer criteria:

[user@user-pc ~]$ find -not -newer recent_file.txt

Remember that the metadata, including all three timestamps, for a file can be manually examined using the stat command.

atime

The find command with the -atime option is used to search for files based on their access time (the time when a file was last accessed). You can specify a time period in days to find files that were accessed within that time frame. Here’s an example:

find /path/to/search -atime -7

In this example:-

find: The command itself for searching files and directories.
/path/to/search: Replace this with the directory path where you want to start the search.
-atime: This is the option to specify that you want to search based on access time.
-7: This indicates that you want to find files that were accessed within the last 7 days. You can replace this number with the desired number of days.

This command will list files in the specified directory (and its subdirectories) that have been accessed within the last 7 days.

mtime

The -mtime option allows you to search for files based on their modification time (in days). You can use this option to find files that were modified within a certain number of days ago. Here’s an example of how to use the find command with the -mtime option:

find /path/to/search -mtime -7

In this example:

/path/to/search is the directory where you want to start your search.
-mtime -7 specifies that you want to find files modified within the last 7 days. The - before the 7 indicates “less than,” so it will find files modified within the past 7 days.

You can adjust the number of days to fit your specific needs. If you want to find files modified more than 7 days ago, you can use -mtime +7 instead.

ctime

The -ctime option in find is used to search for files and directories based on their change time. Specifically, it allows you to find files and directories that were changed (i.e., had their metadata modified) a certain number of 24-hour periods ago.

Here’s an example of how to use the find command with the -ctime option:

find /path/to/search -ctime N

In this command:

/path/to/search should be replaced with the directory where you want to start your search.
N should be replaced with the number of 24-hour periods ago you want to search for. For example:
- -ctime 0 will find files and directories that were changed today.
- -ctime -1 will find files and directories that were changed less than 1 day ago (i.e., within the last 24 hours).
- -ctime +1 will find files and directories that were changed more than 1 day ago.

Here are a few practical examples:

To find all files and directories in the current directory that were changed today:

find . -ctime 0

To find all files and directories in the /home/user/documents directory that were changed less than 7 days ago:

find /home/user/documents -ctime -7

To find all files and directories in the /var/log directory that were changed more than 30 days ago:

find /var/log -ctime +30

Remember that the -ctime option in find is based on the change time, which includes changes to the metadata of a file (e.g., permissions or ownership) and not just the content of the file.

amin

The -amin option in the find command is used to search for files based on their access time in minutes. You can use it to find files that were accessed within a specified number of minutes ago. Here’s an example of how to use the -amin option:

find /path/to/search -amin N

In this command:

/path/to/search is the directory where you want to start your search.
N is the number of minutes ago that you want to use as a criterion for finding files. Replace N with the desired number of minutes.

For example, if you want to find files that were accessed within the last 24 hours (1440 minutes), you can use the following command:

find /path/to/search -amin -1440

This command will find files in the specified directory and its subdirectories that were accessed within the last 1440 minutes (24 hours). You can adjust the value of N to match your specific time criteria.

mmin

The find command with the -mmin option is used to search for files and directories based on their modification time in minutes. You can specify a specific number of minutes ago as a criterion for the search. Here’s an example:

Let’s say you want to find all files in the current directory and its subdirectories that were modified within the last 60 minutes:

find /path/to/search -type f -mmin -60

In this example:

/path/to/search should be replaced with the actual directory path where you want to start the search.
-type f specifies that you are looking for files (not directories).
-mmin -60 means you want to find files that were modified less than 60 minutes ago.

You can adjust the number of minutes as needed to match your specific criteria.

-cmin

The find command with the -cmin option is used to search for files and directories based on their “change time” in minutes. This option allows you to specify a range of time, and find will search for files that have had their status change within that time frame. Here’s an example:

find /path/to/search -cmin -30