List all files modified in the past X days

List all files modified in the past X days

One of the tricks I’ve frequently had to use was to discover all the recently modified files within a hosting account (very useful information in case the account was recently hacked and changed files need to be restored).

For this exact purpose, there’s a good combination of linux commands we can use

for f in `find . -mtime X -type f`; do ls -l $f; done

where X is the number of days (positive, negative, or zero); for example, to list all files modified in the past 3 days, replace X with -3:

for f in `find . -mtime -3 -type f`; do ls -l $f; done

This little command works well for most situations, but will fail in case file names have spaces in them. For this situation, we need to do a temporary change in the linux environment configuration, then revert that change.This is where the IFS variable comes into play.

SAVEIFS=$IFS; IFS=$(echo -en "\n\b"); for f in `find . -mtime -3 -type f`; do ls -l $f; done; IFS=$SAVEIFS

Other timeframes for the mtime parameter:

find . -mtime 0   # find files modified between now and 1 day ago
# (i.e., within the past 24 hours)
find . -mtime -1  # find files modified less than 1 day ago
# (i.e., within the past 24 hours, as before)
find . -mtime 1   # find files modified between 24 and 48 hours ago
find . -mtime +1  # find files modified more than 48 hours ago
find . -mmin +5 -mmin -10 # find files modified between 6 and 9 minutes ago

Leave a Reply