Find Files By Modification Date

by Curtiss   |   last updated March 23, 2010   |   General Tutorials ·

Quite often, I find myself in a situation where I need to figure out which files on my Web server were modified recently. For instance, when I make updates to the development version of my Web site and decide I’m ready to copy those changes over to the production site, I need to find out for sure which files I modified.

This is actually a very simple process when using a *nix-based Web server, assuming you have secure shell (SSH) access. Obviously, these instructions apply to any *nix-based operating system (I’m assuming they also work on Mac, but have not tested), not just Web servers.

To do so, we’ll use the “find” shell command. Find is a pretty powerful and universal search command for Linux/Unix.The Unix “find” command offers a lot of really nice options and switches to control what exactly you’re searching for. The main one we’re going to use is the -mtime switch, which, as you would imagine, finds files based on their “mtime” property. I found a nice tutorial that explains the differences between “atime,” “ctime” and “mtime” if you’re looking for more information on those three terms. As I said, though, for the purposes of this article, we’re just going to focus on the “mtime” property for our files.

The -mtime (likewise the -atime and -ctime) switch expects the time interval you provide to be a number of “days” (24-hour periods). You can enter the parameter in one of three ways:

1. preceded by a plus sign (+), which indicates that you are searching for files that were modified longer ago than the provided time interval.
2. preceded by a minus sign (-), which indicates that you are searching for files that were modified more recently than the provided time interval.
3. not preceded by any symbol, which indicates that you are searching for files that were modified at exactly the time interval you provided.

For instance, if you wanted to search for files that were modified at least three days ago, you would use +3 as your -mtime value. If you wanted to search for files that were modified within the last three days, you would use -3 as your -mtime value. Finally, if you wanted to find files that were modified exactly three days ago, you would just use the number 3 as your -mtime value.

Let’s look at the full command you might use for each of those examples (shown in the order they were mentioned above):

$ find /home/user/Documents/ -mtime +3
$ find /home/user/Documents/ -mtime -3
$ find /home/user/Documents/ -mtime 3

Now, let’s say that you want to search for files that were modified within the last 30 days, and you want to save that list in a file that you can download and view on your computer. That’s where the STDIN and STDOUT concepts of Unix come into play. You can redirect the output from the terminal into any file you choose by simply appending a right angle-bracket after the command, followed by the location of the file you want to store the output in. Warning: If the specified output file already exists, it will be overwritten with the output from this command.

For this situation, your command would look something like:

$ find /home/user/Documents/ -mtime -30 >/home/user/find.log.txt

Now, let’s examine a situation where you only want to find PHP files that have been modified in the last 30 days, and then save that list to your “find.log.txt” file. That would look something like:

$ find /home/user/Documents/ -iname "*.php" -mtime -30 >/home/user/find.log.txt

You can find more information about searching for files according to their modification, access or change time, and some other neat things you can do with the “find” command in a blog post I found on nixCraft.