How to Find Files Based on Timestamp in Linux

The find command in Linux is used to search for files and folders based on different parameters. These parameters can be the filename, size, type of file, etc.

One such parameter is the timestamp of the file. In Linux (and all Unix based file systems) there are 3 timestamps maintained for every file:

  1. Last Modification Time
  2. Last Access Time
  3. Last Status Change Time (i.e., when metadata of the file like permissions are changed)

Let’s see how to use find to search for files based on each of these timestamps.

Find File Timestamps in Linux

First of all, we can run the ‘stat‘ command in Linux to get all these timestamps for a file. For example for a file with the name ‘stat‘, run:

$ stat tmp
Find Stat Timestamps
Find Stat Timestamps

Find Files Based on Timestamp

Now, to find files based on the timestamp, we use the argument '-newerXY' of find from the man page.

man find
Man Page of Find Command
Man Page of Find Command

Thus in the argument '-newerXY', we can have X as a, c, or m, respectively for last access, last status change, and last modification times, and Y as t, so that we can have the next argument to be a timestamp string.

Note: The birth time, i.e. creation time of a file is not maintained in Unix based file systems

To generalize, the command to be run looks like this:

find <directory_path> -newer<a/m/c>t ‘<timestamp>’

Here, the format of the timestamp should be: ‘YYYY-MM-DD HH:MM:SS’.

Let’s try this on a folder with few files and only two files having accessed, modified and status changed after a specified time.

find . -newerat ‘2021-02-19 06:34’
find . -newerct ‘2021-02-19 06:34’
find . -newermt ‘2021-02-19 06:34’
Find Files Based on Timestamp
Find Files Based on Timestamp

Verify with ‘stat’ if the timestamps of both files are indeed greater than the specified time.

stat tmp2 tmp3
Verify File Timestamp
Verify File Timestamp
Conclusion

We have learned how to use the '-newerXY' the argument of command find to search for files based on timestamp.

Note that you can also use another file for a reference timestamp instead of explicitly specifying the timestamp, in which case the ‘t’ from the argument can be skipped.

Thanks a lot for reading and let us know your thoughts in the comments below!

Got something to say? Join the discussion.