How to Find Files Based on Timestamp in Linux

The find command in Linux is used to search for files and folders based on different parameters. These parameters can be the filename, size, type of file, etc.

[ You might also like: How to Find Files Containing Specific Text String in Linux ]

One such parameter is the timestamp of the file. In Linux (and all Unix based file systems) there are 3 timestamps maintained for every file:

1. Last Modification Time
2. Last Access Time
3. Last Status Change Time (i.e., when metadata of the file like permissions are changed)

Let’s see how to use find to search for files based on each of these timestamps.

Find File Timestamps in Linux

First of all, we can run the ‘stat‘ command in Linux to get all these timestamps for a file. For example for a file with the name ‘stat‘, run:

$ stat tmp

Find Files Based on Timestamp

Now, to find files based on the timestamp, we use the argument '-newerXY' of find from the man page.

man find

Thus in the argument '-newerXY', we can have X as a, c, or m, respectively for last access, last status change, and last modification times, and Y as t, so that we can have the next argument to be a timestamp string.

Note: The birth time, i.e. creation time of a file is not maintained in Unix based file systems

To generalize, the command to be run looks like this:

find <directory_path> -newer<a/m/c>t ‘<timestamp>’

Here, the format of the timestamp should be: ‘YYYY-MM-DD HH:MM:SS’.

Let’s try this on a folder with few files and only two files having accessed, modified and status changed after a specified time.

find . -newerat ‘2021-02-19 06:34’
find . -newerct ‘2021-02-19 06:34’
find . -newermt ‘2021-02-19 06:34’

Verify with ‘stat’ if the timestamps of both files are indeed greater than the specified time.

stat tmp2 tmp3

Conclusion

We have learned how to use the '-newerXY' the argument of command find to search for files based on timestamp.

Note that you can also use another file for a reference timestamp instead of explicitly specifying the timestamp, in which case the ‘t’ from the argument can be skipped.

Thanks a lot for reading and let us know your thoughts in the comments below!