find by modification time in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Find files modified exactly 3 days ago

What is the output of this command if the directory contains files modified 1, 3, and 5 days ago?

find . -type f -mtime 3

Linux CLI

find . -type f -mtime 3

A Lists only files modified exactly 3 days ago

B Lists files modified more than 3 days ago

C Lists files modified within the last 3 days

D Lists files modified less than 3 days ago

💡 Hint

Remember, '-mtime n' matches files modified exactly n days ago.

The '-mtime 3' option finds files modified between 72 and 96 hours ago, not less or more.

💻 Command Output

intermediate

Find files modified less than 7 days ago

What does this command list?

find /tmp -type f -mtime -7

Linux CLI

find /tmp -type f -mtime -7

A Files modified between 7 and 14 days ago

B Files modified exactly 7 days ago

C Files modified more than 7 days ago

D Files modified less than 7 days ago

💡 Hint

The minus sign before 7 means less than 7 days.

The '-mtime -7' option matches files modified within the last 7 days (less than 7).

💻 Command Output

advanced

Find files modified more than 10 days ago

What output will this command produce?

find /var/log -type f -mtime +10

Linux CLI

find /var/log -type f -mtime +10

A Files modified less than 10 days ago

B Files modified exactly 10 days ago

C Files modified more than 10 days ago

D Files modified between 5 and 10 days ago

💡 Hint

The plus sign means strictly greater than the number of days.

The '-mtime +10' option finds files modified more than 10 days ago.

🔧 Debug

advanced

Why does this find command fail to list files modified in last 2 days?

You run:

find . -type f -mtime 2

but it does not list files modified yesterday. Why?

Linux CLI

find . -type f -mtime 2

A Because '-mtime 2' matches files modified exactly 2 days ago, not less

B Because '-mtime 2' matches files modified less than 2 days ago

C Because '-mtime 2' matches files modified more than 2 days ago

D Because '-mtime 2' matches files modified within last 2 days

💡 Hint

Check how '-mtime n' works with exact days.

The '-mtime 2' matches files modified between 48 and 72 hours ago, so files modified yesterday (less than 48 hours) are excluded.

🚀 Application

expert

Find and delete files older than 30 days safely

Which command safely finds and deletes files older than 30 days in /home/user/tmp?

A find /home/user/tmp -type f -mtime +30 | xargs rm

B find /home/user/tmp -type f -mtime +30 -delete

C find /home/user/tmp -type f -mtime +30 -exec rm -rf {} \;

D find /home/user/tmp -type f -mtime +30 -exec rm {} \;

💡 Hint

Use the safest and simplest way to delete files with find.

The '-delete' option deletes files safely and efficiently. Option B works but is slower. Option B uses '-rf' which is dangerous for files. Option B can fail with spaces in filenames.

Practice

1. What does the command find . -mtime -3 do in Linux?

easy

A. Finds files modified within the last 3 days

B. Finds files modified exactly 3 days ago

C. Finds files modified more than 3 days ago

D. Finds files modified more than 3 hours ago

Solution

1. Step 1: Understand the meaning of -mtime

   The -mtime option in find searches files by modification time in days.

2. Step 2: Interpret the negative number -3

   A negative number means files modified less than that many days ago, so -3 means within the last 3 days.

3. Final Answer:

   Finds files modified within the last 3 days -> Option A

4. Quick Check:

   -mtime -3 means modified less than 3 days ago [OK]

Hint: Negative -mtime means files modified within last N days [OK]

Common Mistakes:

• Confusing -mtime -3 with exactly 3 days ago
• Thinking -mtime -3 means more than 3 days ago
• Mixing hours with days in -mtime

2. Which of the following is the correct syntax to find files modified exactly 5 days ago?

easy

A. find . -mtime +5

B. find . -mtime 5

C. find . -mtime -5

D. find . -mmin 5

Solution

1. Step 1: Recall the meaning of -mtime with positive number

   -mtime 5 finds files modified exactly 5 days ago (between 5 and 6 days).

2. Step 2: Check other options

   -mtime +5 means more than 5 days ago, -mtime -5 means less than 5 days ago, and -mmin 5 searches by minutes, not days.

3. Final Answer:

   find . -mtime 5 -> Option B

4. Quick Check:

   Exact days use positive number without + or - [OK]

Hint: Exact days use plain number with -mtime (no + or -) [OK]

Common Mistakes:

• Using +5 instead of 5 for exact days
• Using -5 to mean exactly 5 days ago
• Confusing -mtime with -mmin

3. What will be the output of this command if run in a directory with files modified 1, 3, 5, and 7 days ago?
find . -mtime +4

medium

A. ./file_modified_1_day_ago
./file_modified_3_days_ago

B. ./file_modified_3_days_ago
./file_modified_5_days_ago

C. No files found

D. ./file_modified_5_days_ago
./file_modified_7_days_ago

Solution

1. Step 1: Understand +4 with -mtime

   -mtime +4 finds files modified more than 4 days ago (5 days or older).

2. Step 2: Identify files matching condition

   Files modified 5 and 7 days ago match, so they will be listed.

3. Final Answer:

   ./file_modified_5_days_ago ./file_modified_7_days_ago -> Option D

4. Quick Check:

   +4 means older than 4 days [OK]

Hint: Use +N to find files older than N days [OK]

Common Mistakes:

• Including files modified less than or equal to 4 days ago
• Confusing +4 with -4
• Expecting no output when files exist

4. You wrote this command to find files modified within the last 2 days:
find /data -mtime 2
But it returns files modified exactly 2 days ago, not within 2 days. How to fix it?

medium

A. Use find /data -mtime 0

B. Change to find /data -mtime +2

C. Change to find /data -mtime -2

D. Add -mmin -2880 instead

Solution

1. Step 1: Understand what -mtime 2 means

   -mtime 2 finds files modified exactly 2 days ago (between 2 and 3 days).

2. Step 2: Use negative number for 'within last N days'

   To find files modified less than 2 days ago, use -mtime -2.

3. Final Answer:

   Change to find /data -mtime -2 -> Option C

4. Quick Check:

   Negative -mtime means less than N days [OK]

Hint: Use -mtime -N for files modified within last N days [OK]

Common Mistakes:

• Using positive number for 'within' instead of exact days
• Using +2 which means older than 2 days
• Confusing minutes and days options

5. You want to delete files in /backup that were modified more than 10 days ago but keep files modified within 10 days. Which command correctly does this safely?

hard

A. find /backup -mtime +10 -delete

B. find /backup -mtime +10 -exec rm {} \;

C. find /backup -mtime 10 -delete

D. find /backup -mtime -10 -exec rm {} \;

Solution

1. Step 1: Identify files older than 10 days

   -mtime +10 selects files modified more than 10 days ago.

2. Step 2: Use safe deletion option

   -delete deletes files directly; it's safer and simpler than -exec rm which can be error-prone.

3. Step 3: Check other options

   -mtime -10 deletes recent files (wrong), -mtime 10 deletes files exactly 10 days old (not older), and -exec rm works but less safe than -delete.

4. Final Answer:

   find /backup -mtime +10 -delete -> Option A

5. Quick Check:

   Use +N with -delete to remove files older than N days [OK]

Hint: Use -mtime +N with -delete to remove files older than N days [OK]

Common Mistakes:

• Using -mtime -10 deletes recent files instead of old
• Using -mtime 10 deletes only files exactly 10 days old
• Using -exec rm without care can cause errors