164

How to find the files that are created in the last hour in unix

Ankur
  • 2,321
  • 3
  • 17
  • 7

6 Answers6

254

If the dir to search is srch_dir then either

$ find srch_dir -cmin -60 # change time

or

$ find srch_dir -mmin -60 # modification time

or

$ find srch_dir -amin -60 # access time

shows files whose metadata has been changed (ctime), the file contents itself have been modified (mtime), or accessed (atime) in the last hour, respectively.

ctime is non-unintuitive and warrants further explanation:

ctime: Unlike mtime, which is only related to the contents inside a file, changed timestamp indicates the last time some metadata of a file was changed. ctime refers to the last time when a file’s metadata. For example, if permission settings of a file were modified, ctime will indicate it.

ijoseph
  • 6,505
  • 4
  • 26
  • 26
sameer
  • 2,549
  • 1
  • 14
  • 3
  • 2
    This is great and all, but these flags don't exist on Solaris `find` that I'm using. OP said Unix and I think these are Linux only. – jiggy Apr 17 '14 at 19:53
  • 17
    The trick is to use **negative** time values! It's not so obvious in the man page. – sphakka Mar 11 '15 at 14:20
  • @jiggy [Ayush's answer](http://stackoverflow.com/a/5242560/27358) gives a hack (based on `-newer`) that should work on Solaris. – David Moles Mar 31 '16 at 23:09
  • 5
    -cmin is NOT creation time but change time! just deleted my .config dir cause on the test run it wasn't changed withhin the last X minutes and when I did rm it was.... so maybe edit this...! – Badmaster Oct 17 '16 at 16:08
  • I still think the first example comment needs a revision. "change time" is the file status, not the file data – KC Baltz May 14 '20 at 22:30
  • the change in meta data is what states in ctime – Javeed Shakeel Dec 11 '20 at 13:23
  • If I use these together, are they "OR'd"? find . -path "*MORL*" -name "*.TXT" -cmin -1440 -mmin -1440 -amin 1440 – Richard Domingo Apr 08 '22 at 09:56
  • @KCBaltz I gotchu. Just wasted about 6 hours on that myself before divining what it was. – ijoseph Jan 10 '23 at 04:17
25

UNIX filesystems (generally) don't store creation times. Instead, there are only access time, (data) modification time, and (inode) change time.

That being said, find has -atime -mtime -ctime predicates:

$ man 1 find
...
-ctime  n
        The primary shall evaluate as true if the time of last change of
        file status information subtracted from the initialization time,
        divided by 86400 (with any remainder discarded), is n.
...

Thus find -ctime 0 finds everything for which the inode has changed (e.g. includes file creation, but also counts link count and permissions and filesize change) less than an hour ago.

ephemient
  • 198,619
  • 38
  • 280
  • 391
  • 1
    86400 seconds is a *day*, not an hour. Thus the argument to `-ctime` etc is in units of _days_ rather than hours. – Gaylon Aug 02 '19 at 23:24
11

check out this link and then help yourself out.

the basic code is

#create a temp. file
echo "hi " >  t.tmp
# set the file time to 2 hours ago
touch -t 200405121120  t.tmp 
# then check for files
find /admin//dump -type f  -newer t.tmp -print -exec ls -lt {} \; | pg
Jeff
  • 6,646
  • 5
  • 27
  • 33
ayush
  • 14,350
  • 11
  • 53
  • 100
  • Thanks, however this will only search for t.tmp. What if I want to find all the files created in the last hour. – Ankur Mar 09 '11 at 07:36
  • 2
    Ankur : it will create a temporary file t.tmp and set its creation time to 2 hours ago...after that it will search in present directory all files which were created after t.tmp i.e in last 2 hours.. – ayush Mar 09 '11 at 07:43
  • 4
    cool!! Though the first command is not necessary. `touch` creates the file if it does not exists already. – Amir Uval Sep 20 '12 at 08:59
6

find ./ -cTime -1 -type f

OR

find ./ -cmin -60 -type f

Nicolas Pepinster
  • 5,413
  • 2
  • 30
  • 48
gwecho huang
  • 579
  • 2
  • 6
  • 13
3
sudo find / -Bmin 60

From the man page:

-Bmin n

True if the difference between the time of a file's inode creation and the time find was started, rounded up to the next full minute, is n minutes.

Obviously, you may want to set up a bit differently, but this primary seems the best solution for searching for any file created in the last N minutes.

sudon't
  • 39
  • 1
-2

Check out this link for more details.

To find files which are created in last one hour in current directory, you can use -amin

find . -amin -60 -type f

This will find files which are created with in last 1 hour.

Jamre Ludhi
  • 11
  • 1
  • -amin gives you the latest access time, which by some file systems isn't even updated. So cmin and mmin are the options to use. – vboerchers May 23 '22 at 17:49