find by modification time in Linux CLI - Time & Space Complexity

Time Complexity: find by modification time

O(n)

Understanding Time Complexity

When using the find command to search files by modification time, it is important to understand how the time to complete the search grows as the number of files increases.

We want to know how the command's work changes when there are more files to check.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

find /path/to/dir -type f -mtime -7
    

This command finds all files in the given directory modified within the last 7 days.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: Checking each file's metadata (modification time).
• How many times: Once for every file in the directory and its subdirectories.

How Execution Grows With Input

As the number of files grows, the command must check more files, so the work grows proportionally.

Input Size (n)	Approx. Operations
10	About 10 file checks
100	About 100 file checks
1000	About 1000 file checks

Pattern observation: The number of operations grows roughly in direct proportion to the number of files.

Final Time Complexity

Time Complexity: O(n)

This means the time to complete the search grows linearly with the number of files to check.

Common Mistake

[X] Wrong: "The command only checks a few files because it stops early when it finds matches."

[OK] Correct: The find command checks every file to be sure it finds all matches; it does not stop early.

Interview Connect

Understanding how file search commands scale helps you reason about script performance and system load, a useful skill in many automation tasks.

Self-Check

"What if we added a condition to search only in the top directory without recursion? How would the time complexity change?"

Practice

1. What does the command find . -mtime -3 do in Linux?

easy

A. Finds files modified within the last 3 days

B. Finds files modified exactly 3 days ago

C. Finds files modified more than 3 days ago

D. Finds files modified more than 3 hours ago

Solution

1. Step 1: Understand the meaning of -mtime

   The -mtime option in find searches files by modification time in days.

2. Step 2: Interpret the negative number -3

   A negative number means files modified less than that many days ago, so -3 means within the last 3 days.

3. Final Answer:

   Finds files modified within the last 3 days -> Option A

4. Quick Check:

   -mtime -3 means modified less than 3 days ago [OK]

Hint: Negative -mtime means files modified within last N days [OK]

Common Mistakes:

• Confusing -mtime -3 with exactly 3 days ago
• Thinking -mtime -3 means more than 3 days ago
• Mixing hours with days in -mtime

2. Which of the following is the correct syntax to find files modified exactly 5 days ago?

easy

A. find . -mtime +5

B. find . -mtime 5

C. find . -mtime -5

D. find . -mmin 5

Solution

1. Step 1: Recall the meaning of -mtime with positive number

   -mtime 5 finds files modified exactly 5 days ago (between 5 and 6 days).

2. Step 2: Check other options

   -mtime +5 means more than 5 days ago, -mtime -5 means less than 5 days ago, and -mmin 5 searches by minutes, not days.

3. Final Answer:

   find . -mtime 5 -> Option B

4. Quick Check:

   Exact days use positive number without + or - [OK]

Hint: Exact days use plain number with -mtime (no + or -) [OK]

Common Mistakes:

• Using +5 instead of 5 for exact days
• Using -5 to mean exactly 5 days ago
• Confusing -mtime with -mmin

3. What will be the output of this command if run in a directory with files modified 1, 3, 5, and 7 days ago?
find . -mtime +4

medium

A. ./file_modified_1_day_ago
./file_modified_3_days_ago

B. ./file_modified_3_days_ago
./file_modified_5_days_ago

C. No files found

D. ./file_modified_5_days_ago
./file_modified_7_days_ago

Solution

1. Step 1: Understand +4 with -mtime

   -mtime +4 finds files modified more than 4 days ago (5 days or older).

2. Step 2: Identify files matching condition

   Files modified 5 and 7 days ago match, so they will be listed.

3. Final Answer:

   ./file_modified_5_days_ago ./file_modified_7_days_ago -> Option D

4. Quick Check:

   +4 means older than 4 days [OK]

Hint: Use +N to find files older than N days [OK]

Common Mistakes:

• Including files modified less than or equal to 4 days ago
• Confusing +4 with -4
• Expecting no output when files exist

4. You wrote this command to find files modified within the last 2 days:
find /data -mtime 2
But it returns files modified exactly 2 days ago, not within 2 days. How to fix it?

medium

A. Use find /data -mtime 0

B. Change to find /data -mtime +2

C. Change to find /data -mtime -2

D. Add -mmin -2880 instead

Solution

1. Step 1: Understand what -mtime 2 means

   -mtime 2 finds files modified exactly 2 days ago (between 2 and 3 days).

2. Step 2: Use negative number for 'within last N days'

   To find files modified less than 2 days ago, use -mtime -2.

3. Final Answer:

   Change to find /data -mtime -2 -> Option C

4. Quick Check:

   Negative -mtime means less than N days [OK]

Hint: Use -mtime -N for files modified within last N days [OK]

Common Mistakes:

• Using positive number for 'within' instead of exact days
• Using +2 which means older than 2 days
• Confusing minutes and days options

5. You want to delete files in /backup that were modified more than 10 days ago but keep files modified within 10 days. Which command correctly does this safely?

hard

A. find /backup -mtime +10 -delete

B. find /backup -mtime +10 -exec rm {} \;

C. find /backup -mtime 10 -delete

D. find /backup -mtime -10 -exec rm {} \;

Solution

1. Step 1: Identify files older than 10 days

   -mtime +10 selects files modified more than 10 days ago.

2. Step 2: Use safe deletion option

   -delete deletes files directly; it's safer and simpler than -exec rm which can be error-prone.

3. Step 3: Check other options

   -mtime -10 deletes recent files (wrong), -mtime 10 deletes files exactly 10 days old (not older), and -exec rm works but less safe than -delete.

4. Final Answer:

   find /backup -mtime +10 -delete -> Option A

5. Quick Check:

   Use +N with -delete to remove files older than N days [OK]

Hint: Use -mtime +N with -delete to remove files older than N days [OK]

Common Mistakes:

• Using -mtime -10 deletes recent files instead of old
• Using -mtime 10 deletes only files exactly 10 days old
• Using -exec rm without care can cause errors