How to use ‘find’ to search for files created on a specific date

This is one of the pieces that started with me thinking GNU find has an ugly wart, ending with me actually reading the man page, only to find out that the wart isn’t there, and that it’s actually fairly elegant.

Last year, I fell victim to the massive security breach on Dreamhost (note, that Dreamhost were nothing but terrific to me, and they have been for the last five years, so I still recommend them). This resulted in me receiving a delisting notice from Google for certain documents on my site, this morning, because I had somehow failed to nuke the injected spam on at least one document. So, I had to find all documents modified that day.

So, I had to find all of the files modified on . If this was yesterday, or a week ago, using -mtime would have been trivial. However, I can’t tell the offset from today’s date in seconds, minutes, hours or days, so I had to find something better. A quick Google search brought up this, (mis-)quoted below for convenience

$ touch -amt 200601260000 /tmp/ref1
$ touch -amt 200601262359 /tmp/ref2
$ find . -type f -newer /tmp/ref1 -a ! -newer /tmp/ref2

Which, you know, seemed clunky. Having to create two useless files in order to find files createdbetween two dates lands firmly on the ugly side of things, and is just the Wrong Thing To Do. man find to the rescue, which contains this bit:

-newerXY reference
Compares the timestamp of the current file with reference. The
reference argument is normally the name of a file (and one of its
timestamps is used for the comparison) but it may also be a string
describing an absolute time. X and Y are placeholders for other
letters, and these letters select which time belonging to how
reference is used for the comparison.

The relevant placeholders for X and Y are in this case m and t:

m: The modification time of the file reference
t reference is interpreted directly as a time

So, when I want to find all files modified on a certain date, for example, ’2007-06-07′ the final input is:

$ find . -type f -newermt 2007-06-07 ! -newermt 2007-06-08

Better than what I first had feared, no?

Previous Post
Next Post
Comments are closed.