How to display modified date time with 'find' command?

Displaying Modified Date and Time with the 'find' Command in Linux

Learn how to effectively use the 'find' command in Linux to locate files and display their last modification timestamps, including advanced formatting options.

The find command is an indispensable utility in Linux for searching files and directories based on various criteria. While its primary function is to locate files, it can also be leveraged to display detailed information about them, including their modification timestamps. This article will guide you through using find to not only locate files but also to present their last modified date and time in a human-readable format, enhancing your file management and auditing capabilities.

Basic File Search and Modification Time

To begin, let's understand the fundamental way find works. The command typically takes a starting directory and an expression. To display the modification time, we'll use the -printf action, which allows for custom output formatting. The %t format specifier within -printf is key for showing the modification time.

find . -type f -printf "%t %p\n"

Basic find command to list files and their modification timestamps.

In the example above:

• . specifies the current directory as the starting point.
• -type f restricts the search to regular files only.
• -printf "%t %p\n" is the action that formats the output. %t prints the file's last modification time, and %p prints the file's name. \n adds a newline for readability.

Customizing Date and Time Output with find -printf

The %t format specifier in find -printf offers powerful sub-options to control the exact format of the timestamp. This allows you to tailor the output to your specific needs, whether you prefer a short date, a full timestamp, or a specific locale format.

flowchart TD
    A[Start `find` command] --> B{Specify search path and criteria}
    B --> C{Use `-printf` action}
    C --> D["Choose time specifier: %t"]
    D --> E["Apply format flags: %t%H, %t%F, %t%c"]
    E --> F[Output formatted date/time and filename]
    F --> G[End]

    subgraph Time Format Flags
        H["%t%H: Hour (00-23)"]
        I["%t%M: Minute (00-59)"]
        J["%t%S: Second (00-60)"]
        K["%t%F: Full date (YYYY-MM-DD)"]
        L["%t%T: Time (HH:MM:SS)"]
        M["%t%c: Locale's appropriate date and time"]
        N["%t%s: Seconds since Epoch"]
    end
    D --- H
    D --- I
    D --- J
    D --- K
    D --- L
    D --- M
    D --- N

Flowchart illustrating the use of find -printf with various time format specifiers.

Here are some common format specifiers you can use with %t:

• %t%F: Displays the full date in YYYY-MM-DD format.
• %t%T: Displays the time in HH:MM:SS format.
• %t%c: Displays the date and time in the locale's appropriate format.
• %t%s: Displays the number of seconds since the Epoch (January 1, 1970, 00:00:00 UTC).

# Display date only (YYYY-MM-DD)
find . -type f -printf "%t%F %p\n"

# Display time only (HH:MM:SS)
find . -type f -printf "%t%T %p\n"

# Display full date and time (locale-specific)
find . -type f -printf "%t%c %p\n"

# Display seconds since Epoch
find . -type f -printf "%t%s %p\n"

Examples of using different time format specifiers with find -printf.

Combining find with stat for Portability and Advanced Formatting

While -printf is powerful, it's a GNU extension. For environments where GNU find might not be available, or for even more granular control over output, you can combine find with the stat command using find -exec. The stat command provides detailed file information, including various timestamps, and is generally more portable across different Unix-like systems.

find . -type f -exec stat -c "%y %n" {} +

Using find with stat to display modification time and filename.

In this stat example:

• %y refers to the last modification time in human-readable format.
• %n refers to the filename.
• {} is a placeholder for each file found by find.
• + tells find to pass multiple filenames to stat at once, which is more efficient than -exec ... {} \; (which executes stat for each file individually).

Practical Use Cases

Displaying modification times is useful for several scenarios:

• Auditing: Quickly identify recently modified files in a directory.
• Cleanup: Find old files that haven't been touched in a long time.
• Troubleshooting: Pinpoint files that were changed around the time an issue occurred.
• Backup Verification: Ensure that backup processes are correctly updating file timestamps.

1. Find files modified in the last 24 hours

Use -mtime -1 to find files modified less than 24 hours ago, then display their modification time.

2. Find files modified more than 30 days ago

Use -mtime +30 to find files modified more than 30 days ago, and list their modification date.

3. Sort files by modification time

Combine find with sort to order the output by timestamp. This often requires piping the output to sort -k1 (sort by the first column, which is the timestamp).

# Files modified in the last 24 hours
find . -type f -mtime -1 -printf "%t%c %p\n"

# Files modified more than 30 days ago
find . -type f -mtime +30 -printf "%t%F %p\n"

# Sort files by modification time (oldest first)
find . -type f -printf "%t%s %p\n" | sort -n

# Sort files by modification time (newest first)
find . -type f -printf "%t%s %p\n" | sort -nr

Advanced find commands for filtering and sorting by modification time.