Linux command to check new files in file system

Question

We have linux machine we would like to check what new files have been added between a certain date range.

I only have SSH access to this box and it\'s openSUSE 11.1

Answer 1

I misunderstood your question. Depending on what filesystem you are using, it may or may not store creation time.

My understanding is that ext2/3/4 do not store creation time, but modified, changed (status, which is slightly different), and access times are.

Fat32 on the other hand does contain creation timestamps IIRC.

If you are using an ext filesystem, you have two options it seems:

1.Settle for finding all of the files that were modified between two dates (which will include created files, but also files that were just edited). You could do this using find.

2.Create a script/cronjob that will document the contents of your filesystem at some interval, e.g.

find / > filesystem.$(date +%s).log

and then run diffs to see what has been added. This, of course, would prevent you from looking backwards to time before you started making these logs.

Answer 2

There are bunch of ways for doing that.

First one:

start_date=201105040000

end_date=201105042359

touch -t ${start_date} start

touch -t ${end_date} end

find /you/path -type f -name '*you*pattern*' -newer start ! -newer end -exec ls -s {} \;

Second one: find files modified between 20 and 21 days ago:

find -ctime +20 -ctime -21

finds files modified between 2500 and 2800 minutes ago:

find -cmin +2500 -cmin -2800

And read this topic too.

Answer 3

You can try one of these:

find -newerct "1 Aug 2013" ! -newerct "1 Sep 2013" -ls

find . -mtime $(date +%s -d"Jan 1, 2013 23:59:59") -mtime $(date +%s -d"Jan 2, 2016 23:59:59")

find /media/WD/backup/osool/olddata/ -newermt 20120101T1200 -not -newermt 20130101T1400

find . -mtime +1 -mtime -3
find . -mtime +1 -mtime -3 > files_from_yesterday.txt 2>&1
find . -mtime +1 -mtime -3 -ls > files_from_yesterday.txt 2>&1

touch -t 200506011200 first
touch -t 200507121200 last
find / -newer first ! -newer last

#!/bin/bash
for i in `find Your_Mail_Dir/ -newermt "2011-01-01" ! -newermt "2011-12-31"`; do
    mv $i /moved_emails_dir/

Hope this helps.

Answer 4

Well, you could use find to get a list of all the files that were last-modified in a certain time window, but that isn't quite what you want. I don't think you can tell just from a file's metadata when it came into existence.

Edit: To list the files along with their modification dates, you can pipe the output of find through xargs to run ls -l on all the files, which will show the modification time.

find /somepath -type f ... -print0 | xargs -0 -- ls -l