find by modification time in Linux CLI - Mini Project: Build & Apply

Find Files by Modification Time

📖 Scenario: You are managing files on a Linux system. Sometimes you need to find files that were changed recently to clean up or back up important data.

🎯 Goal: Learn how to use the find command to locate files based on their modification time.

📋 What You'll Learn

Create a directory with some files

Set a time threshold variable

Use the find command with the -mtime option

Display the list of files modified within the threshold

💡 Why This Matters

🌍 Real World

System administrators often need to find recently changed files to back up or clean up data.

💼 Career

Knowing how to use <code>find</code> with modification time is essential for Linux system management and scripting automation.

1

Create a directory and files

Create a directory called testdir and inside it create three empty files named file1.txt, file2.txt, and file3.txt.

Linux CLI

# Create directory testdir and three files inside
# Your code here

Hint

Use mkdir to make a directory and touch to create empty files.

2

Set a modification time threshold

Create a variable called days and set it to 1 to represent files modified within the last 1 day.

Linux CLI

mkdir testdir
touch testdir/file1.txt testdir/file2.txt testdir/file3.txt

# Set days variable to 1
# Your code here

Hint

Use days=1 to set the variable.

3

Use find command with modification time

Use the find command to list files in testdir that were modified within the last $days days. Use -mtime -$days option.

Linux CLI

mkdir testdir
touch testdir/file1.txt testdir/file2.txt testdir/file3.txt
days=1

# Use find to list files modified within last $days days
# Your code here

Hint

The -mtime -1 option finds files modified less than 1 day ago.

4

Display the found files

Print the output of the find command that lists files modified within the last $days days.

Linux CLI

mkdir testdir
touch testdir/file1.txt testdir/file2.txt testdir/file3.txt
days=1
find testdir -type f -mtime -$days

# Print the result of find command
# Your code here

Hint

Just run the find command to see the list of files.

Practice

1. What does the command find . -mtime -3 do in Linux?

easy

A. Finds files modified within the last 3 days

B. Finds files modified exactly 3 days ago

C. Finds files modified more than 3 days ago

D. Finds files modified more than 3 hours ago

Solution

1. Step 1: Understand the meaning of -mtime

   The -mtime option in find searches files by modification time in days.

2. Step 2: Interpret the negative number -3

   A negative number means files modified less than that many days ago, so -3 means within the last 3 days.

3. Final Answer:

   Finds files modified within the last 3 days -> Option A

4. Quick Check:

   -mtime -3 means modified less than 3 days ago [OK]

Hint: Negative -mtime means files modified within last N days [OK]

Common Mistakes:

• Confusing -mtime -3 with exactly 3 days ago
• Thinking -mtime -3 means more than 3 days ago
• Mixing hours with days in -mtime

2. Which of the following is the correct syntax to find files modified exactly 5 days ago?

easy

A. find . -mtime +5

B. find . -mtime 5

C. find . -mtime -5

D. find . -mmin 5

Solution

1. Step 1: Recall the meaning of -mtime with positive number

   -mtime 5 finds files modified exactly 5 days ago (between 5 and 6 days).

2. Step 2: Check other options

   -mtime +5 means more than 5 days ago, -mtime -5 means less than 5 days ago, and -mmin 5 searches by minutes, not days.

3. Final Answer:

   find . -mtime 5 -> Option B

4. Quick Check:

   Exact days use positive number without + or - [OK]

Hint: Exact days use plain number with -mtime (no + or -) [OK]

Common Mistakes:

• Using +5 instead of 5 for exact days
• Using -5 to mean exactly 5 days ago
• Confusing -mtime with -mmin

3. What will be the output of this command if run in a directory with files modified 1, 3, 5, and 7 days ago?
find . -mtime +4

medium

A. ./file_modified_1_day_ago
./file_modified_3_days_ago

B. ./file_modified_3_days_ago
./file_modified_5_days_ago

C. No files found

D. ./file_modified_5_days_ago
./file_modified_7_days_ago

Solution

1. Step 1: Understand +4 with -mtime

   -mtime +4 finds files modified more than 4 days ago (5 days or older).

2. Step 2: Identify files matching condition

   Files modified 5 and 7 days ago match, so they will be listed.

3. Final Answer:

   ./file_modified_5_days_ago ./file_modified_7_days_ago -> Option D

4. Quick Check:

   +4 means older than 4 days [OK]

Hint: Use +N to find files older than N days [OK]

Common Mistakes:

• Including files modified less than or equal to 4 days ago
• Confusing +4 with -4
• Expecting no output when files exist

4. You wrote this command to find files modified within the last 2 days:
find /data -mtime 2
But it returns files modified exactly 2 days ago, not within 2 days. How to fix it?

medium

A. Use find /data -mtime 0

B. Change to find /data -mtime +2

C. Change to find /data -mtime -2

D. Add -mmin -2880 instead

Solution

1. Step 1: Understand what -mtime 2 means

   -mtime 2 finds files modified exactly 2 days ago (between 2 and 3 days).

2. Step 2: Use negative number for 'within last N days'

   To find files modified less than 2 days ago, use -mtime -2.

3. Final Answer:

   Change to find /data -mtime -2 -> Option C

4. Quick Check:

   Negative -mtime means less than N days [OK]

Hint: Use -mtime -N for files modified within last N days [OK]

Common Mistakes:

• Using positive number for 'within' instead of exact days
• Using +2 which means older than 2 days
• Confusing minutes and days options

5. You want to delete files in /backup that were modified more than 10 days ago but keep files modified within 10 days. Which command correctly does this safely?

hard

A. find /backup -mtime +10 -delete

B. find /backup -mtime +10 -exec rm {} \;

C. find /backup -mtime 10 -delete

D. find /backup -mtime -10 -exec rm {} \;

Solution

1. Step 1: Identify files older than 10 days

   -mtime +10 selects files modified more than 10 days ago.

2. Step 2: Use safe deletion option

   -delete deletes files directly; it's safer and simpler than -exec rm which can be error-prone.

3. Step 3: Check other options

   -mtime -10 deletes recent files (wrong), -mtime 10 deletes files exactly 10 days old (not older), and -exec rm works but less safe than -delete.

4. Final Answer:

   find /backup -mtime +10 -delete -> Option A

5. Quick Check:

   Use +N with -delete to remove files older than N days [OK]

Hint: Use -mtime +N with -delete to remove files older than N days [OK]

Common Mistakes:

• Using -mtime -10 deletes recent files instead of old
• Using -mtime 10 deletes only files exactly 10 days old
• Using -exec rm without care can cause errors