Finding Newly Created Files

[budhead]

Hello,

Can someone provide me with a way to find newly created files, or more specifically, files created within the last twenty four hours?

I've tried searches such as "ls -lR |grep "Jan 9" |less" which causes the directory to be omitted and returns far too many extraneous results, "find / -mtime 1 -printf %p\\t%k\\n |less" which I believe is only modified files, not created (since it doesn't include a file I know was created within the last day), and any other variations I could think of.

Thank you.

[budhead]

OK, answered my own question.

With find, the mtime value must be 0 for the last twenty-four hours, not 1.

Thanks again.

[wje_lf]

I don't know how you could conclude this.

for find, -mtime is still the modified time, not the created time.

-mtime 0

means files that were most recently modified this very second.

-mtime 1

means files that were most recently modified exactly a day ago, within one second. Either of those is not likely to produce very many files.

-mtime -1

means files that were most recently modified within the most recent 24 hours.

How do you find the creation time, as opposed to the time most recently modified? On Linux, you can't.

You can, though, using recent versions of BSD and the

-Btime

option in find. For C programmers who wish to take advantage of that (on BSD), go here.

[budhead]

I found this version of the man file - find(1) - Linux man page - in which it explains "Search for files in your home directory which have been modified in the last twenty-four hours. This command works this way because the time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to match -mtime 0, a file will have to have a modification in the past which is less than 24 hours ago."

I suggest that it includes files created because it found a file I had just created:

OES-FS02:~ # touch SeansNewFile
OES-FS02:~ # find / -mtime 0 -printf %p\\t%t\\t%b\\t%s\\t%k\\n |grep SeansNewFile |less
find: /proc/8603/task: No such file or directory
find: /proc/21365/task/21365/fd/4: No such file or directory
find: /media/cdrom: No medium found
find: /media/cdrecorder: No medium found
/root/SeansNewFile Thu Jan 10 14:30:37 2008 0 0 0

[wje_lf]

By George. You're right. I thought I had experimented on this before posting my response, but I must have zigged where I should have zagged.

This will help me. Thank you.

But the stuff about creation time as opposed to modification time still holds. (Unless I'm wrong again; it's been known to happen.)

[budhead]

I'm still not clear regarding your statement pertaining to creation vs. modification time.

The file I tested against was a file that I had just created, and did not in any way edit or modify. So in my mind it was never modified. That the find utility did find the file suggests it will locate files created, but not necessarily modified. That's not to say it will not ALSO find files that were modified.

Am I, perhaps, misunderstanding the distinction between created and modified?

[wje_lf]

Am I, perhaps, misunderstanding the distinction between created and modified?

That's a distinct possibility. A file that was created at time X is considered already to be modified at time X. "Modified" does not mean simply "modified since its creation".

[budhead]

Does Linux make any distinction anywhere between modified and created?

It appears for the purposes of the find function there is no distinction between created and modified.

If I create a file and make no modifications to the file, and then view it's properties using stat, it shows Modify and Change as the time the file was created (and I'll point out there is no reference to a creation time). Those times don't seem to change so long as I don't edit the file. If I edit the file, both the Modify and Change times change to the time I edited the file. As far as I can see there is no reference to the date and time the file was created here either.

Is there anywhere where I can view when a file was actually created, or is that just not relevant?

[wje_lf]

it shows Modify and Change as the time the file was created

You'd think that "modified" and "changed" would mean the same thing here, but they don't.

"Modified" means when the data was last modified (or the file was first created, if the data has never been modified).

"Changed" means when the file's directory entry was last changed (or the file was first created, if the file's directory entry has never been changed). The file's directory entry is changed whenever you change the protection mode for the file, or similar change to the whole status of the file.

Is there anywhere where I can view when a file was actually created, or is that just not relevant?

Well, you'd consider it relevant, and I'd consider it relevant, so it's relevant. But it's just not available with standard UNIX systems or with Linux. It's available with BSD, as I point out here.

[budhead]

Having a better understanding of how it all works, I think I can live without the creation date being available.

Thank you for taking the time to go back and forth with me about this.