Linux Tips

Which files changed during the incident window last Tuesday?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #40:

Try: find /var/www -type f -newermt '2026-07-23 14:00:00' ! -newermt '2026-07-23 16:00:00'

Info: -newermt 'DATE' matches files modified AFTER a timestamp. Combined with ! -newermt, it isolates files modified BETWEEN two specific times, making it useful for forensic analysis.

Examples:

  • $ find / -newermt '1 hour ago' -type f 2>/dev/null  # Modified in the last hour
  • $ find /home -newermt yesterday ! -newermt today  # Modified yesterday only
  • $ find /etc -newermt '2026-07-01' ! -newermt '2026-07-31' -type f  # Within date range

Note: Supports natural language strings like 'yesterday', '1 hour ago', or 'last week'. You can also use -newerct for change time or -neweramt for access time.




LinuxTeck.com 
linuxteck@ubuntu:~$ find /app -type f -newermt '2026-07-23 14:00' ! -newermt '2026-07-23 16:00'
/app/site/config.php
/app/site/includes/db.php
/app/site/logs/access.log
/app/site/uploads/user_123.jpg
/app/site/cache/session.dat

linuxteck@ubuntu:~$ find /app -type f -newermt '2026-07-23 14:00' ! -newermt '2026-07-23 16:00' -exec ls -la {} \;
-rw-r--r-- 1 www-data www-data 2345 Jul 23 14:23 /app/site/config.php
-rw-r--r-- 1 www-data www-data 8901 Jul 23 15:12 /app/site/includes/db.php
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #39: How do I access a private database from my laptop through a jump server? NEXT ARTICLE Quick Linux Tip #41: How do I find duplicate files even if they have different names?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.