Arve Bersvendsen

How to use 'find' to search for files created on a specific date

This is one of the pieces that started with me thinking GNU find has an ugly wart, ending with me actually reading the man page, only to find out that the wart isn't there, and that it's actually fairly elegant.

Last year, I fell victim to the massive security breach on Dreamhost (note, that Dreamhost were nothing but terrific to me, and they have been for the last five years, so I still recommend them). This resulted in me receiving a delisting notice from Google for certain documents on my site, this morning, because I had somehow failed to nuke the injected spam on at least one document. So, I had to find all documents modified that day.

So, I had to find all of the files modified on June 7th, 2007. If this was yesterday, or a week ago, using -mtime would have been trivial. However, I can't tell the offset from today's date in seconds, minutes, hours or days, so I had to find something better. A quick Google search brought up this, (mis-)quoted below for convenience

$ touch -amt 200601260000 /tmp/ref1
$ touch -amt 200601262359 /tmp/ref2
$ find . -type f -newer /tmp/ref1 -a ! -newer /tmp/ref2

Which, you know, seemed clunky. Having to create two useless files in order to find files createdbetween two dates lands firmly on the ugly side of things, and is just the Wrong Thing To Do. man find to the rescue, which contains this bit:

-newerXY reference Compares the timestamp of the current file with reference. The reference argument is normally the name of a file (and one of its timestamps is used for the comparison) but it may also be a string describing an absolute time. X and Y are placeholders for other letters, and these letters select which time belonging to how reference is used for the comparison.

The relevant placeholders for X and Y are in this case m and t:

m: The modification time of the file reference t reference is interpreted directly as a time

So, when I want to find all files modified on a certain date, for example, '2007-06-07' the final input is:

$ find . -type f -newermt 2007-06-07 ! -newermt 2007-06-08

Better than what I first had feared, no?