4

Can I do a find and list files where ctime and mtime are not equal?

find . -type f -name '*.php' -ctime -5 MISSING_PART

MISSING_PART: something like -mtime != -ctime

Jonathan Leffler
  • 730,956
  • 141
  • 904
  • 1,278
Tillebeck
  • 3,493
  • 7
  • 42
  • 63
  • 1
    Sorry - I don't know of any such option in "find". I assume you know [the difference between ctime and mtime](http://www.linux-faqs.info/general/difference-between-mtime-ctime-and-atime), and that the two are *usually* the same. SUGGESTION: try writing a script using `stat | cut | diff`: http://linux.die.net/man/2/stat. You can format the output so that ctime is in one column; mtime in another, then "diff" the two columns. – paulsm4 Jun 09 '15 at 00:33
  • Thanks for the tip. The two a typically only diffeent, if someone explicit set the mtime to something else than what is should be (typically a hacker) – Tillebeck Jun 18 '15 at 10:05

1 Answers1

6

This can be obtained using stat command. The stat command is used to display file or file system status. The -c option is used to specify the format of the output of this command. The %n format is used to specify the file name. The %Y is used to specify the time of last modification since epoch and %Z specifies the time of last change since epoch.

The command find . -exec stat -c %n#%Y#%Z {} \; | awk -F# '{if ($2 != $3) print $1}' can be used to extract files whose change time and modification time are not equal.

The -ctime n and -mtime n options for find refer to last changed or modified time since n hours ago. This concept of range of time is not captured in this command.

Pratap
  • 402
  • 2
  • 6
  • It gives me a huge result including loads of cache files. But now I have something to work with. Thanks – Tillebeck Jun 19 '15 at 09:20