find by modification time in Linux CLI - Step-by-Step Execution

Concept Flow - find by modification time

Start: User runs find command

↓

Check each file's modification time

↓

Compare mod time with given criteria

↓

Print file

↓

Repeat for all files

↓

End

The find command checks each file's modification time and prints files matching the time criteria.

Execution Sample

Linux CLI

find . -mtime -2 -print

Find files modified in the last 2 days and print their paths.

Execution Table

Step	File Checked	Modification Time (days ago)	Condition (-mtime -2)	Action
1	./file1.txt	1	1 < 2 (True)	Print ./file1.txt
2	./file2.log	3	3 < 2 (False)	Skip ./file2.log
3	./subdir/file3.md	0	0 < 2 (True)	Print ./subdir/file3.md
4	./oldfile.bak	10	10 < 2 (False)	Skip ./oldfile.bak
5	No more files	-	-	End of search

💡 All files checked, command ends.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	Final
Current File	-	./file1.txt	./file2.log	./subdir/file3.md	./oldfile.bak	No more files
Modification Time (days ago)	-	1	3	0	10	-
Condition (-mtime -2)	-	True	False	True	False	-
Action	-	Print	Skip	Print	Skip	End

Key Moments - 3 Insights

Why does the command print some files but skip others?

Files are printed only if their modification time is less than 2 days ago, as shown in rows 1 and 3 of the execution_table where condition is True.

What does '-mtime -2' mean exactly?

It means files modified less than 2 days ago. The execution_table shows this by comparing each file's mod time to 2.

Why does the command stop after checking all files?

Because find checks every file once. The last row in execution_table shows 'No more files' and ends the search.

Visual Quiz - 3 Questions

Look at the execution_table, what action is taken for './file2.log'?

A Print the file path

B Skip the file

C Delete the file

D Modify the file

💡 Hint

Check row 2 under the 'Action' column in execution_table.

At which step does the condition '-mtime -2' become false for the first time?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Condition (-mtime -2)' column in execution_table rows.

If we change '-mtime -2' to '-mtime -5', what happens to the action for './oldfile.bak'?

A It will be printed

B It will still be skipped

C It will be deleted

D It will cause an error

💡 Hint

Consider that 10 < 5 is false, but 10 < 5 is false, so check how condition changes with -5.

Concept Snapshot

find . -mtime N
- Finds files modified exactly N days ago.
-mtime -N finds files modified less than N days ago.
-mtime +N finds files modified more than N days ago.
Use -print to show matching files.
Example: find . -mtime -2 -print finds files modified in last 2 days.

Full Transcript

The 'find' command with '-mtime' option checks each file's modification time. It compares the file's age in days to the given number. If the file was modified less than the specified days ago (using -mtime -N), it prints the file path. The command repeats this for all files in the directory tree. When no files remain, the command ends. This visual trace shows each file checked, its modification time, whether it meets the condition, and the action taken. Beginners often wonder why some files print and others don't; this is because of the time comparison. The '-mtime' option is a simple way to filter files by age in days.

Practice

1. What does the command find . -mtime -3 do in Linux?

easy

A. Finds files modified within the last 3 days

B. Finds files modified exactly 3 days ago

C. Finds files modified more than 3 days ago

D. Finds files modified more than 3 hours ago

Solution

1. Step 1: Understand the meaning of -mtime

   The -mtime option in find searches files by modification time in days.

2. Step 2: Interpret the negative number -3

   A negative number means files modified less than that many days ago, so -3 means within the last 3 days.

3. Final Answer:

   Finds files modified within the last 3 days -> Option A

4. Quick Check:

   -mtime -3 means modified less than 3 days ago [OK]

Hint: Negative -mtime means files modified within last N days [OK]

Common Mistakes:

• Confusing -mtime -3 with exactly 3 days ago
• Thinking -mtime -3 means more than 3 days ago
• Mixing hours with days in -mtime

2. Which of the following is the correct syntax to find files modified exactly 5 days ago?

easy

A. find . -mtime +5

B. find . -mtime 5

C. find . -mtime -5

D. find . -mmin 5

Solution

1. Step 1: Recall the meaning of -mtime with positive number

   -mtime 5 finds files modified exactly 5 days ago (between 5 and 6 days).

2. Step 2: Check other options

   -mtime +5 means more than 5 days ago, -mtime -5 means less than 5 days ago, and -mmin 5 searches by minutes, not days.

3. Final Answer:

   find . -mtime 5 -> Option B

4. Quick Check:

   Exact days use positive number without + or - [OK]

Hint: Exact days use plain number with -mtime (no + or -) [OK]

Common Mistakes:

• Using +5 instead of 5 for exact days
• Using -5 to mean exactly 5 days ago
• Confusing -mtime with -mmin

3. What will be the output of this command if run in a directory with files modified 1, 3, 5, and 7 days ago?
find . -mtime +4

medium

A. ./file_modified_1_day_ago
./file_modified_3_days_ago

B. ./file_modified_3_days_ago
./file_modified_5_days_ago

C. No files found

D. ./file_modified_5_days_ago
./file_modified_7_days_ago

Solution

1. Step 1: Understand +4 with -mtime

   -mtime +4 finds files modified more than 4 days ago (5 days or older).

2. Step 2: Identify files matching condition

   Files modified 5 and 7 days ago match, so they will be listed.

3. Final Answer:

   ./file_modified_5_days_ago ./file_modified_7_days_ago -> Option D

4. Quick Check:

   +4 means older than 4 days [OK]

Hint: Use +N to find files older than N days [OK]

Common Mistakes:

• Including files modified less than or equal to 4 days ago
• Confusing +4 with -4
• Expecting no output when files exist

4. You wrote this command to find files modified within the last 2 days:
find /data -mtime 2
But it returns files modified exactly 2 days ago, not within 2 days. How to fix it?

medium

A. Use find /data -mtime 0

B. Change to find /data -mtime +2

C. Change to find /data -mtime -2

D. Add -mmin -2880 instead

Solution

1. Step 1: Understand what -mtime 2 means

   -mtime 2 finds files modified exactly 2 days ago (between 2 and 3 days).

2. Step 2: Use negative number for 'within last N days'

   To find files modified less than 2 days ago, use -mtime -2.

3. Final Answer:

   Change to find /data -mtime -2 -> Option C

4. Quick Check:

   Negative -mtime means less than N days [OK]

Hint: Use -mtime -N for files modified within last N days [OK]

Common Mistakes:

• Using positive number for 'within' instead of exact days
• Using +2 which means older than 2 days
• Confusing minutes and days options

5. You want to delete files in /backup that were modified more than 10 days ago but keep files modified within 10 days. Which command correctly does this safely?

hard

A. find /backup -mtime +10 -delete

B. find /backup -mtime +10 -exec rm {} \;

C. find /backup -mtime 10 -delete

D. find /backup -mtime -10 -exec rm {} \;

Solution

1. Step 1: Identify files older than 10 days

   -mtime +10 selects files modified more than 10 days ago.

2. Step 2: Use safe deletion option

   -delete deletes files directly; it's safer and simpler than -exec rm which can be error-prone.

3. Step 3: Check other options

   -mtime -10 deletes recent files (wrong), -mtime 10 deletes files exactly 10 days old (not older), and -exec rm works but less safe than -delete.

4. Final Answer:

   find /backup -mtime +10 -delete -> Option A

5. Quick Check:

   Use +N with -delete to remove files older than N days [OK]

Hint: Use -mtime +N with -delete to remove files older than N days [OK]

Common Mistakes:

• Using -mtime -10 deletes recent files instead of old
• Using -mtime 10 deletes only files exactly 10 days old
• Using -exec rm without care can cause errors