There are various occasions where you would like to search for files that have been changed/created in your Linux system recently or within any time frame. For example, as a system admin, you have done some configuration on your Linux system, but forgot where it was saved. You want to verify whether/how your Linux file system has been tampered with by someone recently. If you would like to find recently updated files on Linux, you can use find command as follows.
To find the most recently modified files, sorted in the reverse order of update time (i.e., the most recently updated files first):
2012-09-14 22:25:14.0000000000 /etc/shadow 2012-08-17 00:56:36.0000000000 /etc/resolv.conf 2012-08-16 23:22:57.0000000000 /etc/ld.so.cache 2012-08-16 23:22:29.0000000000 /etc/mtab 2012-08-16 23:22:04.0000000000 /etc/network/run/ifstate 2012-07-10 01:19:24.0000000000 /etc/papersize ...
The above command sorts files in /etc (and all its subdirectories), in the reverse order of their update time, and prints out the sorted list, along with their location and update time. If you want to examine directories as well, you can omit "-type f" option in the command.
To search for files in /target_directory and all its sub-directories, that have been modified in the last 60 minutes:
To search for files in /target_directory and all its sub-directories, that have been modified in the last 2 days:
To search for files in /target_directory and all its sub-directories no more than 3 levels deep, that have been modified in the last 2 days:
You can also specify the range of update time. To search for files in /target_directory and all its sub-directories, that have been modified in the last 7 days, but not in the last 3 days:
All these commands so far only print out the locations of files that are matched. You can also get detailed file attributes of recently modified files, using "-exec" option as follows.
To search for files in /target_directory (and all its sub-directories) that have been modified in the last 60 minutes, and print out their file attributes:
Alternatively, you can use xargs command to achieve the same thing:
Note that files that have been "created" within the specified time frame will also matched by these commands.
Subscribe to Xmodulo
Do you want to receive Linux FAQs, detailed tutorials and tips published at Xmodulo? Enter your email address below, and we will deliver our Linux posts straight to your email box, for free. Delivery powered by Google Feedburner.
Did you find this tutorial helpful? Then please be generous and support Xmodulo!
Latest posts by Dan Nanni (see all)
- How to install Suricata intrusion detection system on Linux - September 3, 2015
- How to switch from NetworkManager to systemd-networkd on Linux - August 31, 2015
- How to set up a system status page of your infrastructure - August 25, 2015