A Linux operating system administrator or veteran user understands and relates to the implications of unmet file management routines and objectives. File management improves the overall workflow such that each user’s actions are associated with specific file changes or modifications.
[ You might also like: Ripgrep – The Fastest Command Line Search Tool for Linux ]
It makes it easy to note any viable changes or modifications made on a system or user file data, the system user that made the file changes or modifications, and the time stamp associated with each file change and modification.
In Linux, achieving such a feat is possible through the Linux command line environment using the find command.
Linux Find Command
The Linux find command is effective in identifying the changes associated with a particular system or user file over a specified time frame. Therefore, if you have a file whose data you think has had some modification or changes, you can clarify your suspicion through the find command.
The basic syntax of the find command is as follows:
$ find /directory/path/to/your/files -mtime -N -ls
As per the above syntax:
- find: This command segment is responsible for tracing the existence of any modified file(s) based on the provided file location path.
- /directory/path/to/your/files: This portion is the system path that points to the suspected modified files that interest you.
- -mtime -N: This portion holds the time value (-N) in an integer format. The -N is the specified period/time range you wish to check for the existence of any file modification footprints.
- -ls: If modified files exist in your targeted directory, it will list and display them as Linux terminal outputs.
Find Files Modified in Last 24 Hours Using Find Command
To demonstrate the possible existence of files modified on your Linux system within the last 24 hours, we would implement a find command similar to the following:
$ find /path/to/your/files/directory -mtime -1 -ls
From the above command syntax, the find command portion “-1” references a 24-hour time frame or a day since any file modifications might have taken place.
On my end, I will check the possibility of any file modifications on one of my system folders as follows:
$ find /home/dnyce/Documents/Work/LinuxShellTips/September -mtime -1 -ls
As per the above screen capture output, the file “how to convert xlsx to CSVFormat in Linux.docx” has tested positive for being modified within the last 24-hour window. A more detailed output of the above screen capture is as follows:
We now know the read-write privileges (-rw-rw-r–), system user (dnyce), file size (958150 bytes), and modification time (16:28) associated with the listed file.
If we want to stretch our output for a period like the last 3 days, we would implement this command in the following manner:
$ find /home/dnyce/Documents/Work/LinuxShellTips/September -mtime -3 -ls
As you can see, we have more output files that have tested positive for modification.
The Linux find command can help you achieve a lot in terms of the priceless file management milestones it provides. You not only get to pinpoint the modified files but also determine other critical information like the user that made the modification, the time of the modification, and the size of the file after the modification.
To explore more find command options, run man find on your Linux terminal or read the following articles.
