Linux Tips

How to Find Files Changed During a Specific Time in Linux

- by John Britto - Leave a Comment - 2 min read
Quick Linux Tip #72:

Question: How do I find files changed within a specific time window for an incident report?

Try: find /var/www -type f -newermt '2026-09-10 14:00:00' ! -newermt '2026-09-10 16:00:00' -printf '%TY-%Tm-%Td %TH:%TM %p\n'

Info: -newermt filters files newer than a specified timestamp. Prefixing it with ! creates an upper time boundary, allowing you to isolate files modified within a precise time window. -printf formats the results with timestamps and file paths.

Examples:

  • $ find /home -type f -newermt yesterday  # Files modified since yesterday
  • $ find / -type f -newermt '1 hour ago' 2>/dev/null  # Files modified in the last hour
  • $ find /etc -type f -newermt '2026-09-01' ! -newermt '2026-09-30'  # Filter by date range

Note: -newermt accepts natural-language expressions such as 'yesterday' and '2 hours ago'. Use -newermt for modification time, -newerct for attribute change time, and -neweramt for access time. This is especially useful when investigating which files changed during a specific incident window.




LinuxTeck.com 
linuxteck@ubuntu:~$ find /var/www -type f -newermt '2026-09-10 14:00:00' ! -newermt '2026-09-10 16:00:00' -printf '%TY-%Tm-%Td %TH:%TM %p\n'
2026-09-10 14:23 /var/www/site/config.php
2026-09-10 14:45 /var/www/site/includes/db.php
2026-09-10 15:02 /var/www/site/logs/access.log
2026-09-10 15:34 /var/www/site/uploads/user_123.jpg
2026-09-10 15:56 /var/www/site/cache/session.dat
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #71: How to Trace Dynamic Library Calls in Linux with ltrace
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.