Bird
Raised Fist0
Linux CLIscripting~5 mins

find by modification time in Linux CLI - Cheat Sheet & Quick Revision

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Recall & Review
beginner
What does the find command option -mtime do?
It finds files based on when they were last modified. You can specify how many days ago the file was changed.
Click to reveal answer
beginner
How do you find files modified exactly 3 days ago using find?
Use find . -mtime 3. This finds files modified between 3 and 4 days ago.
Click to reveal answer
beginner
What does -mtime +5 mean in the find command?
It finds files modified more than 5 days ago (older than 5 days).
Click to reveal answer
beginner
What does -mtime -2 mean in the find command?
It finds files modified less than 2 days ago (newer than 2 days).
Click to reveal answer
beginner
Why is find . -mtime 0 useful?
It finds files modified within the last 24 hours. This is helpful to see very recent changes.
Click to reveal answer
Which command finds files modified more than 7 days ago?
Afind . -mtime +7
Bfind . -mtime -7
Cfind . -mtime 7
Dfind . -mtime 0
What does find . -mtime 1 find?
AFiles modified more than 1 day ago
BFiles modified less than 1 day ago
CFiles modified today
DFiles modified exactly 1 day ago (between 1 and 2 days)
How to find files modified within the last 24 hours?
Afind . -mtime 1
Bfind . -mtime +0
Cfind . -mtime 0
Dfind . -mtime -1
What does -mtime -3 mean?
AFiles modified less than 3 days ago
BFiles modified exactly 3 days ago
CFiles modified more than 3 days ago
DFiles modified 0 days ago
If you want to find files modified between 2 and 3 days ago, which command is correct?
Afind . -mtime 3
Bfind . -mtime 2
Cfind . -mtime -2 -mtime +3
Dfind . -mtime +2 -mtime -3
Explain how to use the find command to locate files modified within the last 5 days.
Think about how <code>-mtime</code> with a minus sign works.
You got /3 concepts.
    Describe the difference between -mtime 3, -mtime +3, and -mtime -3 in the find command.
    Consider how the plus and minus signs change the meaning.
    You got /4 concepts.

      Practice

      (1/5)
      1. What does the command find . -mtime -3 do in Linux?
      easy
      A. Finds files modified within the last 3 days
      B. Finds files modified exactly 3 days ago
      C. Finds files modified more than 3 days ago
      D. Finds files modified more than 3 hours ago

      Solution

      1. Step 1: Understand the meaning of -mtime

        The -mtime option in find searches files by modification time in days.

      2. Step 2: Interpret the negative number -3

        A negative number means files modified less than that many days ago, so -3 means within the last 3 days.

      3. Final Answer:

        Finds files modified within the last 3 days -> Option A

      4. Quick Check:

        -mtime -3 means modified less than 3 days ago [OK]
      Hint: Negative -mtime means files modified within last N days [OK]
      Common Mistakes:
      • Confusing -mtime -3 with exactly 3 days ago
      • Thinking -mtime -3 means more than 3 days ago
      • Mixing hours with days in -mtime
      2. Which of the following is the correct syntax to find files modified exactly 5 days ago?
      easy
      A. find . -mtime +5
      B. find . -mtime 5
      C. find . -mtime -5
      D. find . -mmin 5

      Solution

      1. Step 1: Recall the meaning of -mtime with positive number

        -mtime 5 finds files modified exactly 5 days ago (between 5 and 6 days).

      2. Step 2: Check other options

        -mtime +5 means more than 5 days ago, -mtime -5 means less than 5 days ago, and -mmin 5 searches by minutes, not days.

      3. Final Answer:

        find . -mtime 5 -> Option B

      4. Quick Check:

        Exact days use positive number without + or - [OK]
      Hint: Exact days use plain number with -mtime (no + or -) [OK]
      Common Mistakes:
      • Using +5 instead of 5 for exact days
      • Using -5 to mean exactly 5 days ago
      • Confusing -mtime with -mmin
      3. What will be the output of this command if run in a directory with files modified 1, 3, 5, and 7 days ago?
      find . -mtime +4
      medium
      A. ./file_modified_1_day_ago ./file_modified_3_days_ago
      B. ./file_modified_3_days_ago ./file_modified_5_days_ago
      C. No files found
      D. ./file_modified_5_days_ago ./file_modified_7_days_ago

      Solution

      1. Step 1: Understand +4 with -mtime

        -mtime +4 finds files modified more than 4 days ago (5 days or older).

      2. Step 2: Identify files matching condition

        Files modified 5 and 7 days ago match, so they will be listed.

      3. Final Answer:

        ./file_modified_5_days_ago ./file_modified_7_days_ago -> Option D

      4. Quick Check:

        +4 means older than 4 days [OK]
      Hint: Use +N to find files older than N days [OK]
      Common Mistakes:
      • Including files modified less than or equal to 4 days ago
      • Confusing +4 with -4
      • Expecting no output when files exist
      4. You wrote this command to find files modified within the last 2 days:
      find /data -mtime 2
      But it returns files modified exactly 2 days ago, not within 2 days. How to fix it?
      medium
      A. Use find /data -mtime 0
      B. Change to find /data -mtime +2
      C. Change to find /data -mtime -2
      D. Add -mmin -2880 instead

      Solution

      1. Step 1: Understand what -mtime 2 means

        -mtime 2 finds files modified exactly 2 days ago (between 2 and 3 days).

      2. Step 2: Use negative number for 'within last N days'

        To find files modified less than 2 days ago, use -mtime -2.

      3. Final Answer:

        Change to find /data -mtime -2 -> Option C

      4. Quick Check:

        Negative -mtime means less than N days [OK]
      Hint: Use -mtime -N for files modified within last N days [OK]
      Common Mistakes:
      • Using positive number for 'within' instead of exact days
      • Using +2 which means older than 2 days
      • Confusing minutes and days options
      5. You want to delete files in /backup that were modified more than 10 days ago but keep files modified within 10 days. Which command correctly does this safely?
      hard
      A. find /backup -mtime +10 -delete
      B. find /backup -mtime +10 -exec rm {} \;
      C. find /backup -mtime 10 -delete
      D. find /backup -mtime -10 -exec rm {} \;

      Solution

      1. Step 1: Identify files older than 10 days

        -mtime +10 selects files modified more than 10 days ago.

      2. Step 2: Use safe deletion option

        -delete deletes files directly; it's safer and simpler than -exec rm which can be error-prone.

      3. Step 3: Check other options

        -mtime -10 deletes recent files (wrong), -mtime 10 deletes files exactly 10 days old (not older), and -exec rm works but less safe than -delete.

      4. Final Answer:

        find /backup -mtime +10 -delete -> Option A

      5. Quick Check:

        Use +N with -delete to remove files older than N days [OK]
      Hint: Use -mtime +N with -delete to remove files older than N days [OK]
      Common Mistakes:
      • Using -mtime -10 deletes recent files instead of old
      • Using -mtime 10 deletes only files exactly 10 days old
      • Using -exec rm without care can cause errors
      Recommended

      Ready to prove it?

      Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

      10 questions~5 mineasy hard